Analysis
-
max time kernel
134s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2022, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
main-file-setup/main-file-setup.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
main-file-setup/main-file-setup.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
main-file-setup/main-file-setup.exe
-
Size
550.0MB
-
MD5
ca89705a231aabedd38eae9c3001db3b
-
SHA1
a1e6c57986789a8cbc6c4d54ba3382dafef30f0b
-
SHA256
4196cb4e7ce6c3de44472fc67075ac56b9f5971f8fcf706e06edeca3a94e88d9
-
SHA512
6791283bb8f4704446df861d1e8c5102cd27c3e483326bc5c2231bd541c8344c9ebde96e3b921dcf27b918f58a312ef8b466e3f67875580f8689a6335db83749
-
SSDEEP
6144:sDSyydUgNDebfYDZWbg5c53u+cEIJ5nz59/cqok+trxLRsd9FtkEWU98ek6Br80X:LVN6bggSYqYthI/NLH3Sn2vLTl0A
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 35 4400 powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
pid Process 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4400 set thread context of 3508 4400 powershell.exe 92 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4400 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1556 wrote to memory of 4400 1556 main-file-setup.exe 86 PID 1556 wrote to memory of 4400 1556 main-file-setup.exe 86 PID 1556 wrote to memory of 4400 1556 main-file-setup.exe 86 PID 4400 wrote to memory of 3508 4400 powershell.exe 92 PID 4400 wrote to memory of 3508 4400 powershell.exe 92 PID 4400 wrote to memory of 3508 4400 powershell.exe 92 PID 4400 wrote to memory of 3508 4400 powershell.exe 92 PID 4400 wrote to memory of 3508 4400 powershell.exe 92 PID 4400 wrote to memory of 3508 4400 powershell.exe 92 PID 4400 wrote to memory of 3508 4400 powershell.exe 92 PID 4400 wrote to memory of 3508 4400 powershell.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\main-file-setup\main-file-setup.exe"C:\Users\Admin\AppData\Local\Temp\main-file-setup\main-file-setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵PID:3508
-
-