dcb337bee0f782bbe55524424516c7b9b56d35e9ced8931870e4ce9467861540

General

Target

setup_JC.exe
Size

503KB
MD5

1954869eee7c68693ad83c2c9116d739
SHA1

2cb820b3b0c3581033cca1a0cb49c97d1c3f0eb1
SHA256

dcb337bee0f782bbe55524424516c7b9b56d35e9ced8931870e4ce9467861540
SHA512

d94aa54872825d6093297304c3278b699e050bf8cc0a0a0043fc8b2518bb4c0ea309cd11f35a141ca5df3178dac66ae91a0068094bfb7b6284cdb145ffd0a054
SSDEEP

12288:T8HjWTxA6M8erwyFeGA8HjWTxA6M8erwyFeGb:gK1D9Y7K1D9Yb

Score

8^/10

evasion

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
16	3520	powershell.exe
17	3520	powershell.exe
18	3520	powershell.exe
19	3520	powershell.exe

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
3180	netsh.exe
4352	netsh.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3520	powershell.exe
3520	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeIncreaseQuotaPrivilege	3520	powershell.exe
Token: SeSecurityPrivilege	3520	powershell.exe
Token: SeTakeOwnershipPrivilege	3520	powershell.exe
Token: SeLoadDriverPrivilege	3520	powershell.exe
Token: SeSystemProfilePrivilege	3520	powershell.exe
Token: SeSystemtimePrivilege	3520	powershell.exe
Token: SeProfSingleProcessPrivilege	3520	powershell.exe
Token: SeIncBasePriorityPrivilege	3520	powershell.exe
Token: SeCreatePagefilePrivilege	3520	powershell.exe
Token: SeBackupPrivilege	3520	powershell.exe
Token: SeRestorePrivilege	3520	powershell.exe
Token: SeShutdownPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeSystemEnvironmentPrivilege	3520	powershell.exe
Token: SeRemoteShutdownPrivilege	3520	powershell.exe
Token: SeUndockPrivilege	3520	powershell.exe
Token: SeManageVolumePrivilege	3520	powershell.exe
Token: 33	3520	powershell.exe
Token: 34	3520	powershell.exe
Token: 35	3520	powershell.exe
Token: 36	3520	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2768	996	setup_JC.exe	80
PID 996 wrote to memory of 2768	996	setup_JC.exe	80
PID 2768 wrote to memory of 3520	2768	setup_JC.exe	81
PID 2768 wrote to memory of 3520	2768	setup_JC.exe	81
PID 3520 wrote to memory of 3180	3520	powershell.exe	83
PID 3520 wrote to memory of 3180	3520	powershell.exe	83
PID 3520 wrote to memory of 4352	3520	powershell.exe	89
PID 3520 wrote to memory of 4352	3520	powershell.exe	89
PID 996 wrote to memory of 5044	996	setup_JC.exe	90
PID 996 wrote to memory of 5044	996	setup_JC.exe	90

C:\Users\Admin\AppData\Local\Temp\setup_JC.exe
"C:\Users\Admin\AppData\Local\Temp\setup_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\setup_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_JC.exe" -sfxwaitall:1 "powershell" -ExecutionPolicy ByPass -command ". 'C:\Users\Admin\AppData\Local\Temp\Adobe Temp\BlockIPs.ps1'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy ByPass -command ". 'C:\Users\Admin\AppData\Local\Temp\Adobe Temp\BlockIPs.ps1'"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule "name=Adobe Unlicensed Pop-up" dir=out
      4⤵
      Modifies Windows Firewall
      PID:3180
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule "name=Adobe Unlicensed Pop-up" dir=out action=block remoteip=107.22.247.231,18.207.85.246,23.22.254.206,34.193.227.236,52.202.204.11,52.5.13.197,54.144.73.197,54.227.187.23 enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c IF DEFINED InstChk ( START "" "C:\Users\Admin\AppData\Local\Temp\..\Set-up.exe" )
  2⤵
  PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Adobe Temp\BlockIPs.ps1

Filesize
815B

MD5
2e798b6feac167fa762069c8435a12c9

SHA1
53596bf699253b05cd474f93c5ee85b30fd6b9a8

SHA256
2c9749c8aec272078929de8133c8bde41e89cb2f606b4d51b65a08f334dc5403

SHA512
28daea32cd10d03117f25f75dd54dccaefad84007652a1703807eb951f276daa42cabeb03f8cde06ffee0700dfe1ba1fd537179a79095e93e4ff33e3e381aa23

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4uddfvcr.xh3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3520-135-0x0000025EAA120000-0x0000025EAA142000-memory.dmp

Filesize
136KB

Download
memory/3520-145-0x00007FFFFAD90000-0x00007FFFFB851000-memory.dmp

Filesize
10.8MB

Download
memory/3520-146-0x0000025EAA1F0000-0x0000025EAA200000-memory.dmp

Filesize
64KB

Download
memory/3520-147-0x0000025EAA1F0000-0x0000025EAA200000-memory.dmp

Filesize
64KB

Download
memory/3520-149-0x0000025EAA1F0000-0x0000025EAA200000-memory.dmp

Filesize
64KB

Download
memory/3520-150-0x0000025EAA1D0000-0x0000025EAA1E0000-memory.dmp

Filesize
64KB

Download
memory/3520-151-0x0000025EAA660000-0x0000025EAA67A000-memory.dmp

Filesize
104KB

Download
memory/3520-154-0x00007FFFFAD90000-0x00007FFFFB851000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads