7b26ff94fbfdec8d00f71dd83d88a0d2b3caf4ea807d2fc02474b90283671a1f

Analysis

max time kernel
89s
max time network
156s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.windows.386.exe
Size

4.3MB
MD5

b55c1f114e2627e4ed912dce3f52cf4f
SHA1

17e64e6983f4e95b347529c688dd936a4f46f09d
SHA256

7b26ff94fbfdec8d00f71dd83d88a0d2b3caf4ea807d2fc02474b90283671a1f
SHA512

7075b3acb3afa3927bcf1ed70ec0fe4138afa19a5c502f1bef3e56ea4133361648fe6409e0592ce3131e3e2c1f8bae19728b39e8963219943b6b4c1079d8ca2a
SSDEEP

49152:PKsmZEsgm7zK8cluafG2VmFzNudjzD4nBYHjDUrjJqKm5OLitfHW+doG5F1ew2K:CJafckxmFAdjzUsDUD+2

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (131719) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2128	sc.exe
1488	sc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1044	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 856	900	client.windows.386.exe	30
PID 900 wrote to memory of 856	900	client.windows.386.exe	30
PID 900 wrote to memory of 856	900	client.windows.386.exe	30
PID 900 wrote to memory of 856	900	client.windows.386.exe	30
PID 856 wrote to memory of 1548	856	client.windows.386.exe	31
PID 856 wrote to memory of 1548	856	client.windows.386.exe	31
PID 856 wrote to memory of 1548	856	client.windows.386.exe	31
PID 856 wrote to memory of 1548	856	client.windows.386.exe	31
PID 1548 wrote to memory of 2128	1548	cmd.exe	33
PID 1548 wrote to memory of 2128	1548	cmd.exe	33
PID 1548 wrote to memory of 2128	1548	cmd.exe	33
PID 1548 wrote to memory of 2128	1548	cmd.exe	33
PID 856 wrote to memory of 1044	856	client.windows.386.exe	34
PID 856 wrote to memory of 1044	856	client.windows.386.exe	34
PID 856 wrote to memory of 1044	856	client.windows.386.exe	34
PID 856 wrote to memory of 1044	856	client.windows.386.exe	34
PID 1044 wrote to memory of 2320	1044	powershell.exe	36
PID 1044 wrote to memory of 2320	1044	powershell.exe	36
PID 1044 wrote to memory of 2320	1044	powershell.exe	36
PID 1044 wrote to memory of 2320	1044	powershell.exe	36
PID 2320 wrote to memory of 1488	2320	cmd.exe	37
PID 2320 wrote to memory of 1488	2320	cmd.exe	37
PID 2320 wrote to memory of 1488	2320	cmd.exe	37
PID 2320 wrote to memory of 1488	2320	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\client.windows.386.exe
"C:\Users\Admin\AppData\Local\Temp\client.windows.386.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\client.windows.386.exe
  C:\Users\Admin\AppData\Local\Temp\client.windows.386.exe -f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C sc qc netserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\SysWOW64\sc.exe
      sc qc netserv
      4⤵
      Launches sc.exe
      PID:2128
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand YwBtAGQALgBlAHgAZQAgAC8AYwAgAHMAYwAgAGMAcgBlAGEAdABlACAAbgBlAHQAcwBlAHIAdgAgAGIAaQBuAFAAYQB0AGgAPQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABDAEwASQBFAE4AVAB+ADEALgBFAFgARQAiACAAdAB5AHAAZQA9ACAAbwB3AG4AIABzAHQAYQByAHQAPQAgAGEAdQB0AG8A
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c sc create netserv binPath= C:\Users\Admin\AppData\Local\Temp\CLIENT~1.EXE type= own start= auto
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\SysWOW64\sc.exe
        
        sc create netserv binPath= C:\Users\Admin\AppData\Local\Temp\CLIENT~1.EXE type= own start= auto
        5⤵
        Launches sc.exe
        
        PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-56-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/1044-58-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/1044-57-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/1044-59-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/1044-60-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download