Analysis
- max time kernel
141s - max time network
31s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
15/06/2023, 16:28
General
- Target SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe
- Size 1.5MB
- Sample230615-tynblaae38
- SHA256 49cd63e293adf099e468e6612b0d7cff4c4d5b3cf23cb67a7ed701e19381c2db
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Kills process with taskkill 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SELTP.tmp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp"C:\Users\Admin\AppData\Local\Temp\is-SELTP.tmp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp" /SL5="$80022,1304684,54272,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /IM3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /IM3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /IM Pos.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /IM ServiceUpd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp
SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp
_shfoldr.dll
_shfoldr.dll
memory/1752-68-0x0000000000250000-0x0000000000251000-memory.dmp
memory/1752-70-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1752-71-0x0000000000250000-0x0000000000251000-memory.dmp
memory/2008-54-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2008-69-0x0000000000400000-0x0000000000414000-memory.dmp