Analysis

  • max time kernel
    300s
  • max time network
    291s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/02/2023, 22:47

General

  • Target

    c6bf32612e9edda0f05636131ee97f6d651a252fe31858d01baa8c402dadf7e9.ps1

  • Size

    552B

  • MD5

    e4e334efd3ed0f23499a75127e2662aa

  • SHA1

    7e460968dcbc7ddc8b8c6ede94798e54fbfc5e63

  • SHA256

    c6bf32612e9edda0f05636131ee97f6d651a252fe31858d01baa8c402dadf7e9

  • SHA512

    75d26061e143542f13a05839b054aaaac2146b5ea79bcf94b587169e822f27c525a8cf30f39e3048d5249346adacbeb2695a45a68e0bee48fdd2035ed068ade8

Malware Config

Signatures

  • Detects Smokeloader packer 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c6bf32612e9edda0f05636131ee97f6d651a252fe31858d01baa8c402dadf7e9.ps1
    1⤵
    • Blocklisted process makes network request
    • Deletes itself
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Users\Admin\AppData\Local\Temp\agent.exe
      "C:\Users\Admin\AppData\Local\Temp\agent.exe"
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3928
  • C:\Users\Admin\AppData\Local\Temp\F15A.exe
    C:\Users\Admin\AppData\Local\Temp\F15A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1896
  • C:\Users\Admin\AppData\Local\Temp\F1E7.exe
    C:\Users\Admin\AppData\Local\Temp\F1E7.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    PID:3076
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
    • Accesses Microsoft Outlook profiles
    • outlook_office_path
    • outlook_win_path
    PID:4436
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    1⤵
      PID:4124
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
        PID:760
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:4816
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:3992
          • C:\Users\Admin\AppData\Roaming\F15A.exe
            C:\Users\Admin\AppData\Roaming\F15A.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4396

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\F15A.exe.log

                  Filesize

                  621B

                  MD5

                  431293de3fad018871bc380403c6f53c

                  SHA1

                  935699de6ea2086cec2612f7716d147ced286768

                  SHA256

                  1d7ced4ac3efd413157af7c0d8167ab87f1060c576dc86e5518283874df2b55f

                  SHA512

                  b33b49ffb96a325da7b6d77b3c95014b2b6ff985fd6553ce80487789a8d8b56e4e24d0f819108c271146ccd188d1a7d68ba630441b065f9ddb47602297fa6c62

                • C:\Users\Admin\AppData\Local\Temp\F15A.exe

                  Filesize

                  465KB

                  MD5

                  978efdcbc93c6c9ac15e01fda1054d7c

                  SHA1

                  23e777d93caa97b0f167f728905df31e6efaac23

                  SHA256

                  1cc7239194b15a44c4f7bb2a5edab03b319d3ebba56a84ac59f860acc9e2f35c

                  SHA512

                  c25d414af7d5354666f5ce4d88719374af180a265fdfd604a8c3d054df506a0154c98cc8ca4da972a018870df576455afd3804d45ae39ac7fc3c8b1c4e2329e3

                • C:\Users\Admin\AppData\Local\Temp\F15A.exe

                  Filesize

                  465KB

                  MD5

                  978efdcbc93c6c9ac15e01fda1054d7c

                  SHA1

                  23e777d93caa97b0f167f728905df31e6efaac23

                  SHA256

                  1cc7239194b15a44c4f7bb2a5edab03b319d3ebba56a84ac59f860acc9e2f35c

                  SHA512

                  c25d414af7d5354666f5ce4d88719374af180a265fdfd604a8c3d054df506a0154c98cc8ca4da972a018870df576455afd3804d45ae39ac7fc3c8b1c4e2329e3

                • C:\Users\Admin\AppData\Local\Temp\F1E7.exe

                  Filesize

                  141KB

                  MD5

                  4da855885a48a88b2b99abdaf7dbaddb

                  SHA1

                  95be38902672a4f729325f4322449fafe52791c4

                  SHA256

                  e6e5fa379b321d66c93d236eadc5c81478c821b545a7ff9ac6d07e14ed5a8983

                  SHA512

                  4f5855573c3d08d8a11325775230544ecf79f884009a94c30c8bd4547e2ad873224ef1d34fd15b9e91423a5cf4351f22d4aa50be7c14cc2bdc2260c009e61c93

                • C:\Users\Admin\AppData\Local\Temp\F1E7.exe

                  Filesize

                  141KB

                  MD5

                  4da855885a48a88b2b99abdaf7dbaddb

                  SHA1

                  95be38902672a4f729325f4322449fafe52791c4

                  SHA256

                  e6e5fa379b321d66c93d236eadc5c81478c821b545a7ff9ac6d07e14ed5a8983

                  SHA512

                  4f5855573c3d08d8a11325775230544ecf79f884009a94c30c8bd4547e2ad873224ef1d34fd15b9e91423a5cf4351f22d4aa50be7c14cc2bdc2260c009e61c93

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33ocsag4.dv0.ps1

                  Filesize

                  1B

                  MD5

                  c4ca4238a0b923820dcc509a6f75849b

                  SHA1

                  356a192b7913b04c54574d18c28d46e6395428ab

                  SHA256

                  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                  SHA512

                  4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                • C:\Users\Admin\AppData\Local\Temp\agent.exe

                  Filesize

                  29KB

                  MD5

                  1496b98fe0530da47982105a87a69bce

                  SHA1

                  00719a1b168c8baa3827a161326b157713f9a07a

                  SHA256

                  c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d

                  SHA512

                  286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6

                • C:\Users\Admin\AppData\Local\Temp\agent.exe

                  Filesize

                  29KB

                  MD5

                  1496b98fe0530da47982105a87a69bce

                  SHA1

                  00719a1b168c8baa3827a161326b157713f9a07a

                  SHA256

                  c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d

                  SHA512

                  286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6

                • C:\Users\Admin\AppData\Roaming\F15A.exe

                  Filesize

                  465KB

                  MD5

                  978efdcbc93c6c9ac15e01fda1054d7c

                  SHA1

                  23e777d93caa97b0f167f728905df31e6efaac23

                  SHA256

                  1cc7239194b15a44c4f7bb2a5edab03b319d3ebba56a84ac59f860acc9e2f35c

                  SHA512

                  c25d414af7d5354666f5ce4d88719374af180a265fdfd604a8c3d054df506a0154c98cc8ca4da972a018870df576455afd3804d45ae39ac7fc3c8b1c4e2329e3

                • C:\Users\Admin\AppData\Roaming\F15A.exe

                  Filesize

                  465KB

                  MD5

                  978efdcbc93c6c9ac15e01fda1054d7c

                  SHA1

                  23e777d93caa97b0f167f728905df31e6efaac23

                  SHA256

                  1cc7239194b15a44c4f7bb2a5edab03b319d3ebba56a84ac59f860acc9e2f35c

                  SHA512

                  c25d414af7d5354666f5ce4d88719374af180a265fdfd604a8c3d054df506a0154c98cc8ca4da972a018870df576455afd3804d45ae39ac7fc3c8b1c4e2329e3

                • C:\Users\Admin\AppData\Roaming\trawtev

                  Filesize

                  29KB

                  MD5

                  1496b98fe0530da47982105a87a69bce

                  SHA1

                  00719a1b168c8baa3827a161326b157713f9a07a

                  SHA256

                  c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d

                  SHA512

                  286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6

                • memory/760-291-0x0000000000830000-0x000000000089B000-memory.dmp

                  Filesize

                  428KB

                • memory/760-253-0x00000000008D0000-0x00000000008D9000-memory.dmp

                  Filesize

                  36KB

                • memory/760-1035-0x0000000000830000-0x000000000089B000-memory.dmp

                  Filesize

                  428KB

                • memory/760-293-0x00000000008D0000-0x00000000008D9000-memory.dmp

                  Filesize

                  36KB

                • memory/1836-131-0x00000236CA130000-0x00000236CA1A6000-memory.dmp

                  Filesize

                  472KB

                • memory/1836-129-0x00000236AF920000-0x00000236AF930000-memory.dmp

                  Filesize

                  64KB

                • memory/1836-130-0x00000236AF920000-0x00000236AF930000-memory.dmp

                  Filesize

                  64KB

                • memory/1836-126-0x00000236B1150000-0x00000236B1172000-memory.dmp

                  Filesize

                  136KB

                • memory/1896-233-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-188-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-194-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-196-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-1039-0x000000001D1F0000-0x000000001D244000-memory.dmp

                  Filesize

                  336KB

                • memory/1896-199-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-201-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-203-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-207-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-1038-0x000000001C470000-0x000000001C4BC000-memory.dmp

                  Filesize

                  304KB

                • memory/1896-181-0x0000000000950000-0x00000000009C8000-memory.dmp

                  Filesize

                  480KB

                • memory/1896-204-0x000000001C4E0000-0x000000001C4F0000-memory.dmp

                  Filesize

                  64KB

                • memory/1896-210-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-212-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-214-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-216-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-1034-0x000000001C4E0000-0x000000001C4F0000-memory.dmp

                  Filesize

                  64KB

                • memory/1896-222-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-224-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-1033-0x0000000003360000-0x00000000033B6000-memory.dmp

                  Filesize

                  344KB

                • memory/1896-190-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-238-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-240-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-242-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-244-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-246-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-186-0x000000001C3D0000-0x000000001C470000-memory.dmp

                  Filesize

                  640KB

                • memory/1896-248-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-251-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-192-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-254-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-256-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-258-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-260-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-262-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-264-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/1896-187-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                  Filesize

                  624KB

                • memory/3200-166-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

                  Filesize

                  88KB

                • memory/3928-165-0x0000000000400000-0x0000000000409000-memory.dmp

                  Filesize

                  36KB

                • memory/3928-168-0x0000000000400000-0x0000000000409000-memory.dmp

                  Filesize

                  36KB

                • memory/3992-1037-0x00000000005F0000-0x00000000005F9000-memory.dmp

                  Filesize

                  36KB

                • memory/3992-565-0x00000000005F0000-0x00000000005F9000-memory.dmp

                  Filesize

                  36KB

                • memory/3992-567-0x0000000000D80000-0x0000000000D89000-memory.dmp

                  Filesize

                  36KB

                • memory/4124-225-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

                  Filesize

                  48KB

                • memory/4124-221-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

                  Filesize

                  48KB

                • memory/4396-1045-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4396-1864-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4396-1866-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4396-1865-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4396-1867-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4396-1868-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4436-206-0x00000000008A0000-0x0000000000920000-memory.dmp

                  Filesize

                  512KB

                • memory/4436-197-0x0000000000830000-0x000000000089B000-memory.dmp

                  Filesize

                  428KB

                • memory/4436-208-0x0000000000830000-0x000000000089B000-memory.dmp

                  Filesize

                  428KB

                • memory/4436-249-0x0000000000830000-0x000000000089B000-memory.dmp

                  Filesize

                  428KB

                • memory/4816-1036-0x00000000008D0000-0x00000000008D9000-memory.dmp

                  Filesize

                  36KB

                • memory/4816-421-0x00000000005F0000-0x00000000005F9000-memory.dmp

                  Filesize

                  36KB

                • memory/4816-420-0x00000000008D0000-0x00000000008D9000-memory.dmp

                  Filesize

                  36KB