be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b

Resubmissions

18/10/2022, 04:32

221018-e51g6seeb810

18/10/2022, 04:06

221018-epj59aedd67

18/10/2022, 03:34

221018-d417mseefj10

Analysis

max time kernel
132s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
Size 521KB
Sample221018-epj59aedd6
SHA256 be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b
MD5 c0318aa61a314fed79c87be28f0db3ba
SHA1 361e5206d2e0aeb88174c524e6c7cfb90c94670d
SHA512 619ad72faaa694d7dd141288c8f99738d3110fb2e08ea9a5feda3777d4d32456feca66a2e0da96a0610f475e358cb9bb99fc54a179fb98674f91cb205ff7a586
SSDEEP 12288:bjNYGB77lC5eQoyLKWRIvwr222Zy+CQI1Cr2H:bjN99J2eOWF22ZaTe
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SvcManager\svcmgr.exe	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	4500	WerFault.exe	81

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5056	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4764	powershell.exe
4764	powershell.exe
1704	powershell.exe
1704	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1540	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	83
PID 4500 wrote to memory of 1540	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	83
PID 4500 wrote to memory of 1540	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	83
PID 1540 wrote to memory of 4548	1540	cmd.exe	84
PID 1540 wrote to memory of 4548	1540	cmd.exe	84
PID 1540 wrote to memory of 4548	1540	cmd.exe	84
PID 4548 wrote to memory of 4312	4548	net.exe	85
PID 4548 wrote to memory of 4312	4548	net.exe	85
PID 4548 wrote to memory of 4312	4548	net.exe	85
PID 4500 wrote to memory of 2516	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	86
PID 4500 wrote to memory of 2516	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	86
PID 4500 wrote to memory of 2516	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	86
PID 2516 wrote to memory of 4764	2516	cmd.exe	87
PID 2516 wrote to memory of 4764	2516	cmd.exe	87
PID 2516 wrote to memory of 4764	2516	cmd.exe	87
PID 4500 wrote to memory of 5016	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	88
PID 4500 wrote to memory of 5016	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	88
PID 4500 wrote to memory of 5016	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	88
PID 5016 wrote to memory of 1704	5016	cmd.exe	89
PID 5016 wrote to memory of 1704	5016	cmd.exe	89
PID 5016 wrote to memory of 1704	5016	cmd.exe	89
PID 4500 wrote to memory of 3376	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	90
PID 4500 wrote to memory of 3376	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	90
PID 4500 wrote to memory of 3376	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	90
PID 4500 wrote to memory of 2088	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	91
PID 4500 wrote to memory of 2088	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	91
PID 4500 wrote to memory of 2088	4500	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	91
PID 2088 wrote to memory of 5056	2088	cmd.exe	94
PID 2088 wrote to memory of 5056	2088	cmd.exe	94
PID 2088 wrote to memory of 5056	2088	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
"C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user %username%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\net.exe
    net user Admin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Admin
      4⤵
      PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Set-ExecutionPolicy bypass -Force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Set-ExecutionPolicy bypass -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q C:\Windows\SvcManager
  2⤵
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 560
  2⤵
  - Program crash
  PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4500 -ip 4500
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 80d19c23e407ccffe9f5b43087c752b2157294a1e42d887705b9924ceb9e6af9
MD5 74beabd4347b1ecc24fdc6cd9bb2ec64
SHA1 b793909bd2bf91d40eafb71194cc3eeb0c057110
SHA512 f36be6d71e6ae79ffa79e9bc8d57e79cc14ace932fcc2106ab4df8f4ba99506dac3c007d986dfe3bf8884977a411ba1faa713489dc27b25c23bec49d42abd802
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 30e6843c43da1a546871f529ab4a63b0a5f9945a822ae8a6558c66bae1b1c440
MD5 3bbcaef80efd276d964234458ae33c44
SHA1 153adf610e820059657b3f78a318d154d1289ef4
SHA512 f3ebaea9234c53cba0186e4b6a0c16f328f7bc76b02ffa13b41a582239c67aad5fe3cf68bedab418b97799d347a2fc59e2a5525e502cc1708ae06427f9912d5c
SSDEEP 384:1sf+U99i+FFs3/G1VQgsho9oPaSwK6seYLME/B03Soew6fYigcjE7klQdCbv:qfRFcejqSoPaSwNgrqS/iCE70D
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1704-160-0x0000000007890000-0x0000000007898000-memory.dmp

Download

memory/1704-159-0x0000000007960000-0x000000000797A000-memory.dmp

Download

memory/1704-158-0x0000000007840000-0x000000000784E000-memory.dmp

Download

memory/1704-157-0x0000000070610000-0x000000007065C000-memory.dmp

Download

memory/4500-140-0x00000000022B0000-0x0000000002351000-memory.dmp

Download

memory/4500-141-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/4500-165-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/4500-161-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/4500-139-0x00000000007C2000-0x000000000081E000-memory.dmp

Download

memory/4764-143-0x0000000006130000-0x0000000006196000-memory.dmp

Download

memory/4764-150-0x0000000007C20000-0x0000000007C3A000-memory.dmp

Download

memory/4764-152-0x0000000007EA0000-0x0000000007F36000-memory.dmp

Download

memory/4764-146-0x0000000006ED0000-0x0000000006F02000-memory.dmp

Download

memory/4764-144-0x0000000006210000-0x0000000006276000-memory.dmp

Download

memory/4764-145-0x0000000006920000-0x000000000693E000-memory.dmp

Download

memory/4764-142-0x0000000005A50000-0x0000000005A72000-memory.dmp

Download

memory/4764-151-0x0000000007C90000-0x0000000007C9A000-memory.dmp

Download

memory/4764-149-0x0000000008260000-0x00000000088DA000-memory.dmp

Download

memory/4764-138-0x0000000005A90000-0x00000000060B8000-memory.dmp

Download

memory/4764-137-0x0000000003000000-0x0000000003036000-memory.dmp

Download

memory/4764-148-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

Download

memory/4764-147-0x0000000070610000-0x000000007065C000-memory.dmp

Download