Overview

overview

10

Static

static

10

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

data/plugi...Ve.dll

windows7-x64

1

data/plugi...Ve.dll

windows10-2004-x64

1

data/plugi...ff.bat

windows7-x64

1

data/plugi...ff.bat

windows10-2004-x64

1

data/plugi...on.bat

windows7-x64

1

data/plugi...on.bat

windows10-2004-x64

1

data/plugi...ff.bat

windows7-x64

1

data/plugi...ff.bat

windows10-2004-x64

1

data/plugi...on.bat

windows7-x64

1

data/plugi...on.bat

windows10-2004-x64

1

data/scrip...de.ps1

windows7-x64

1

data/scrip...de.ps1

windows10-2004-x64

1

data/scrip...ps.ps1

windows7-x64

1

data/scrip...ps.ps1

windows10-2004-x64

1

data/scrip...ps.ps1

windows7-x64

1

data/scrip...ps.ps1

windows10-2004-x64

1

data/scrip...ve.ps1

windows7-x64

1

data/scrip...ve.ps1

windows10-2004-x64

10

data/scrip...d).ps1

windows7-x64

1

data/scrip...d).ps1

windows10-2004-x64

8

data/scrip...d).ps1

windows7-x64

1

data/scrip...d).ps1

windows10-2004-x64

1

data/scrip...ps.ps1

windows7-x64

1

data/scrip...ps.ps1

windows10-2004-x64

1

data/scrip...es.ps1

windows7-x64

8

data/scrip...es.ps1

windows10-2004-x64

8

data/scrip...ct.ps1

windows7-x64

1

data/scrip...ct.ps1

windows10-2004-x64

8

data/scrip...de.ps1

windows7-x64

1

data/scrip...de.ps1

windows10-2004-x64

1

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2023, 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    data/scripts/Apps/Reinstall all built-in apps.ps1

  • Size

    381B

  • MD5

    bfea03a6ba35c48fce393eeaafe141bb

  • SHA1

    5521ed51db25cda755448e0cc11b90c819b049ac

  • SHA256

    75dba22055266906644d6030adf31ecc319d1fc974b75dceae24fd4e1b352220

  • SHA512

    8906ad70eae1fd6534075ba65d72d40bd9bc54478dab0a3026819f56752f7daf38845e99d2b87e5b37483e24ee7d8c90fe24fce2fee797dc1afdd8ba78622852

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\data\scripts\Apps\Reinstall all built-in apps.ps1"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4252
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3120
  • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
    "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2036
  • C:\Windows\system32\wwahost.exe
    "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3728
  • C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe
    "C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe" -ServerName:App.AppXffn3yxqvgawq9fpmnhy90fr3y01d1t5b.mca
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2772
  • C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
    "C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe" -ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca
    1⤵
    • Checks processor information in registry
    • Modifies registry class
    PID:3952
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.XboxIdentityProvider_8wekyb3d8bbwe
    1⤵
      PID:5392
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5508

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2036-167-0x0000026ED3560000-0x0000026ED356E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2036-189-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2036-169-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2036-168-0x0000026ED39F0000-0x0000026ED39F8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/3120-146-0x000001D3422F0000-0x000001D342310000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3120-164-0x000001D34422A000-0x000001D34422D000-memory.dmp

      Filesize

      12KB

      Download

    • memory/3120-163-0x000001D34422A000-0x000001D34422D000-memory.dmp

      Filesize

      12KB

      Download

    • memory/3120-151-0x000001D3412C0000-0x000001D3412C8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/3120-154-0x000001D342FC0000-0x000001D342FE0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3120-156-0x000001D344226000-0x000001D34422A000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3120-157-0x000001D344226000-0x000001D34422A000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3120-158-0x000001D344226000-0x000001D34422A000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3120-159-0x000001D344226000-0x000001D34422A000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3120-160-0x000001D344226000-0x000001D34422A000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3120-162-0x000001D34422A000-0x000001D34422D000-memory.dmp

      Filesize

      12KB

      Download

    • memory/3120-165-0x000001D34422A000-0x000001D34422D000-memory.dmp

      Filesize

      12KB

      Download

    • memory/4252-137-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4252-132-0x00000294079B0000-0x00000294079D2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4252-136-0x0000029424790000-0x00000294247B6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/4252-135-0x0000029424510000-0x000002942451A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4252-134-0x00000294217B0000-0x00000294217C6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/4252-133-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4252-192-0x00007FFCFF2D0000-0x00007FFCFFD91000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5508-190-0x000001B958140000-0x000001B958150000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5508-191-0x000001B958240000-0x000001B958250000-memory.dmp

      Filesize

      64KB

      Download