Resubmissions
11/10/2022, 17:08
221011-vnmsrafbdn610/10/2022, 15:31
221010-syaj3acdb31009/10/2022, 15:59
221009-tfb6lshbg41009/10/2022, 15:28
221009-swtvxshceq1009/10/2022, 13:04
221009-qa2brshab71009/10/2022, 13:03
221009-qaj3gshab6109/10/2022, 12:59
221009-p8jnyahaa61009/10/2022, 12:54
221009-p5m7yshbdm1008/10/2022, 21:32
221008-1dxg4afgb81008/10/2022, 13:52
221008-q6p9daegh51Analysis
- max time kernel
369s - max time network
1588s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
10/10/2022, 15:31
General
- Target fucker script.exe
- Size 104KB
- Sample221010-syaj3acdb3
- SHA256 52972a23ab12b95cd51d71741db2cf276749e56030c092e2e4f0907dcb1fbd56
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fucker script.exe"C:\Users\Admin\AppData\Local\Temp\fucker script.exe"1⤵
-
C:\Windows\system32\pcwrun.exeC:\Windows\system32\pcwrun.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" ContextMenu1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msdt.exeC:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCWC671.xml /skip TRUE2⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
PCWC671.xml
memory/2792-132-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-140-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-123-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-124-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-125-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-126-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-127-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-128-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-129-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-130-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-131-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-120-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-122-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-121-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-139-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-136-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-137-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-138-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-135-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-133-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-141-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-142-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2792-134-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/4676-151-0x0000020FED8B0000-0x0000020FED8D2000-memory.dmp
memory/4676-154-0x0000020FED960000-0x0000020FED9D6000-memory.dmp