702722319c2f771675257417051213d26a9709ef6dd1c867e093e6f407fcdfae

Resubmissions

19/09/2022, 14:34

220919-rxg23sdab5 10

19/09/2022, 14:30

220919-rvd8eaggaj 10

Analysis

max time kernel
184s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aasd.ps1
Size

194KB
MD5

d5bda808df861bbda7835e9cc88bf8f8
SHA1

d8044382a5f1e3f855d1882e7d6447fc1111947e
SHA256

702722319c2f771675257417051213d26a9709ef6dd1c867e093e6f407fcdfae
SHA512

9a758e4bc523529f8264622d047a5ea6c2a69d01887db22c919f681e4c2a69b15e6f540076f1c99e386ef4985ac5047d284abb40c8a8a0b8c4b29d0ea0ca98d0
SSDEEP

3072:BN3qRnrPNhO0Vm9AdbTPJls5JeuGsP32mF4WQx8x8AYjmY8yoZNBd0Y2Du5/ASQt:6RjtVuwT/s5J7zGdZC28yYH0KB7+

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
15	4108	powershell.exe
21	4108	powershell.exe
30	4108	powershell.exe
41	4108	powershell.exe
58	4108	powershell.exe
59	4108	powershell.exe
60	4108	powershell.exe
61	4108	powershell.exe
62	4108	powershell.exe
63	4108	powershell.exe
64	4108	powershell.exe
65	4108	powershell.exe
66	4108	powershell.exe
67	4108	powershell.exe
68	4108	powershell.exe
69	4108	powershell.exe
70	4108	powershell.exe
71	4108	powershell.exe
72	4108	powershell.exe
73	4108	powershell.exe
74	4108	powershell.exe
75	4108	powershell.exe
76	4108	powershell.exe
77	4108	powershell.exe
78	4108	powershell.exe
79	4108	powershell.exe
80	4108	powershell.exe
81	4108	powershell.exe
82	4108	powershell.exe
83	4108	powershell.exe
84	4108	powershell.exe
85	4108	powershell.exe
86	4108	powershell.exe
87	4108	powershell.exe
88	4108	powershell.exe
89	4108	powershell.exe
90	4108	powershell.exe
91	4108	powershell.exe
92	4108	powershell.exe
93	4108	powershell.exe
94	4108	powershell.exe
95	4108	powershell.exe
96	4108	powershell.exe
97	4108	powershell.exe
98	4108	powershell.exe
101	4108	powershell.exe
102	4108	powershell.exe
103	4108	powershell.exe
104	4108	powershell.exe
105	4108	powershell.exe
108	4108	powershell.exe
109	4108	powershell.exe
110	4108	powershell.exe
111	4108	powershell.exe
112	4108	powershell.exe
113	4108	powershell.exe
114	4108	powershell.exe
115	4108	powershell.exe
116	4108	powershell.exe
117	4108	powershell.exe
118	4108	powershell.exe
119	4108	powershell.exe
120	4108	powershell.exe
121	4108	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4344	notepad.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4132	powershell.exe
4132	powershell.exe
4108	powershell.exe
4108	powershell.exe
4160	powershell_ise.exe
4160	powershell_ise.exe
4160	powershell_ise.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	4160	powershell_ise.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5084	OpenWith.exe
5084	OpenWith.exe
5084	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4108	4132	powershell.exe	82
PID 4132 wrote to memory of 4108	4132	powershell.exe	82
PID 4132 wrote to memory of 4108	4132	powershell.exe	82
PID 5084 wrote to memory of 4344	5084	OpenWith.exe	96
PID 5084 wrote to memory of 4344	5084	OpenWith.exe	96

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\aasd.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- \??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
  "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\AppData\Local\Temp\aasd.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\aasd.ps1"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
57KB

MD5
6c73df1bb0c83bf158c1aebc058fbdd2

SHA1
c3f64dbe2337cf4be331efaed86e600076d613cf

SHA256
2bfd8c972f6bb05ae1adca5237a7210d569fb1f9662ad4dd6bfc4e00e88d17ba

SHA512
a9093e7a6808cbe9aa86eb9eb1d50513e942800da5ffc9685c670a34d2349019caa65705dcd6e959de4b066673e3c45b64b5a94b7589c057817ec61eb65188e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
50KB

MD5
df835563b654667dabdbbfaf27ac1162

SHA1
a53209d58d5e2db1c1b78769097968d28f82bd17

SHA256
c4d3f417b46af89deb8356ff1f313ff37ddceb589f23ea0bf1a06fbeac588cd4

SHA512
c44938a93901c3f43b830646768f166d0c22708a92b365de132a6a6f2934abda43dae023c1c9df5b19d5114319e809406108250bea60ecabb6f545a0db6ad047

Download Submit
memory/4108-140-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Filesize
408KB

Download
memory/4108-141-0x0000000006200000-0x0000000006266000-memory.dmp

Filesize
408KB

Download
memory/4108-137-0x0000000003330000-0x0000000003366000-memory.dmp

Filesize
216KB

Download
memory/4108-138-0x0000000005BD0000-0x00000000061F8000-memory.dmp

Filesize
6.2MB

Download
memory/4108-139-0x0000000005A50000-0x0000000005A72000-memory.dmp

Filesize
136KB

Download
memory/4108-148-0x00000000071D0000-0x000000000784A000-memory.dmp

Filesize
6.5MB

Download
memory/4108-142-0x00000000069B0000-0x00000000069CE000-memory.dmp

Filesize
120KB

Download
memory/4108-146-0x00000000071D0000-0x000000000784A000-memory.dmp

Filesize
6.5MB

Download
memory/4108-143-0x0000000007850000-0x0000000007ECA000-memory.dmp

Filesize
6.5MB

Download
memory/4108-144-0x0000000006F70000-0x0000000006F8A000-memory.dmp

Filesize
104KB

Download
memory/4132-133-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

Filesize
10.8MB

Download
memory/4132-147-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

Filesize
10.8MB

Download
memory/4132-132-0x0000022341780000-0x00000223417A2000-memory.dmp

Filesize
136KB

Download
memory/4132-135-0x0000022341FC0000-0x00000223421CA000-memory.dmp

Filesize
2.0MB

Download
memory/4132-134-0x0000022341C30000-0x0000022341DA6000-memory.dmp

Filesize
1.5MB

Download
memory/4160-152-0x0000025263CE0000-0x0000025263D2A000-memory.dmp

Filesize
296KB

Download
memory/4160-158-0x00000252655C0000-0x00000252655C8000-memory.dmp

Filesize
32KB

Download
memory/4160-153-0x0000025247AC0000-0x0000025247ACE000-memory.dmp

Filesize
56KB

Download
memory/4160-154-0x0000025263D30000-0x0000025263D68000-memory.dmp

Filesize
224KB

Download
memory/4160-155-0x0000025247B70000-0x0000025247B78000-memory.dmp

Filesize
32KB

Download
memory/4160-156-0x0000025263D90000-0x0000025263D98000-memory.dmp

Filesize
32KB

Download
memory/4160-157-0x0000025263DA0000-0x0000025263DA8000-memory.dmp

Filesize
32KB

Download
memory/4160-150-0x0000025245E70000-0x0000025245EA8000-memory.dmp

Filesize
224KB

Download
memory/4160-159-0x0000025265630000-0x0000025265656000-memory.dmp

Filesize
152KB

Download
memory/4160-151-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

Filesize
10.8MB

Download
memory/4160-161-0x0000025265740000-0x000002526575C000-memory.dmp

Filesize
112KB

Download
memory/4160-162-0x0000025265730000-0x000002526573A000-memory.dmp

Filesize
40KB

Download
memory/4160-163-0x0000025265750000-0x0000025265758000-memory.dmp

Filesize
32KB

Download
memory/4160-164-0x0000025265760000-0x000002526576A000-memory.dmp

Filesize
40KB

Download
memory/4160-165-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

Filesize
10.8MB

Download