11e3923cc252bb9022a41a9f5b73672ea8b0798e4492e603ac088d913d7c80c0

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-05-2023 17:09

Target

NOTIFICACION JUDICIAL.exe
Size

475KB
MD5

d872fbe973a4799e94f57abdc594b37e
SHA1

b16837fd4ce58947536360e301e985c7d37d6b1c
SHA256

11e3923cc252bb9022a41a9f5b73672ea8b0798e4492e603ac088d913d7c80c0
SHA512

772f155b664316993bfaa04f4fdf54d9f0b41f7a11ecb39bf7a9409f7afecf612f1ebdf2df7ef548b967291edee1e639d723b6e4c16fc0b36be414e45ac2d53f
SSDEEP

6144:w9TKnLFNE2Dg5PjGnBEYfzTFYIKwstHLzizUblgFBNc3d2RohDAF:w9TKDyxYfz5mwCH/iclgFBGNSoy

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 2000 powershell.exe
6 2000 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2000 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2000 powershell.exe

flow	pid	process
4	2000	powershell.exe
6	2000	powershell.exe

pid	process
2000	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

NOTIFICACION JUDICIAL.exe

description	pid	process	target process
PID 2040 wrote to memory of 2000	2040	NOTIFICACION JUDICIAL.exe	powershell.exe
PID 2040 wrote to memory of 2000	2040	NOTIFICACION JUDICIAL.exe	powershell.exe
PID 2040 wrote to memory of 2000	2040	NOTIFICACION JUDICIAL.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\NOTIFICACION JUDICIAL.exe
"C:\Users\Admin\AppData\Local\Temp\NOTIFICACION JUDICIAL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -F C:/ProgramData/md9fmn2uj52E8Ut8f5xmiH0j4abpph3A.ps1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

C:\ProgramData\md9fmn2uj52E8Ut8f5xmiH0j4abpph3A.ps1

Filesize
23KB

MD5
d2e91c11db4839b18d3e90afc151709d

SHA1
53fdca35ab2eb30ca7ac9f6a2a4fa14523055ca6

SHA256
05c4f31e351d6e97164ec3a249d0c11f32323bcc1c77172c800ae2ac5fb3d8d4

SHA512
888122d0bb2b04edc854860a10729ba6724dcaa9c1867a899850b9809435a13147b95003d717252ba0daae888935f76467d585bec563364ab21698cdc225b008

Download Submit
memory/2000-59-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download
memory/2000-60-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2000-61-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2000-62-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2000-64-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download