Analysis

  • max time kernel
    1187s
  • max time network
    1209s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2023 22:40

General

  • Target

    installer-package.exe

  • Size

    302.3MB

  • MD5

    5846dc26ee52c800031bbb1939c771c2

  • SHA1

    cbdd0a97644525e705a2d18005738a92a4f48b6d

  • SHA256

    a0114420ff98f4f09df676527add4ccaaf4326b4bd0c87b153d1ea71adf50022

  • SHA512

    e84048e02239ad8c78ea3d57cbc705d283c630514dc9cbc316d7edba54a7e5b33c95b8ed40d6fe23d74e4d19308f078e39955465df7a2e2d7cd71fd73d0f662f

  • SSDEEP

    49152:ihduY5Y45wfJqs4W+f3jJa3ppppppppppppppppppppppppppppppppppppppppV:iy

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\installer-package.exe
    "C:\Users\Admin\AppData\Local\Temp\installer-package.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hdyuejwd.jak.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\ibundle386dist.exe

    Filesize

    135B

    MD5

    8035849c312227caf8d4788cb9d0fec6

    SHA1

    00e3ac9e638bbe84bb8721aabe9e223dad33aa12

    SHA256

    c84687a3a7a4dae90c70ddc68ac4a1e302d6e017265d5d3b9639c160ad297589

    SHA512

    e86bb1db37ac5a99a41f055251eab38934ac6cb0e7829695fd60a37e1fbdd92a667bdfa9d4099eb8833a0cfb607d8a2ecd6178afaf599619c3966dd9636a4298

  • memory/2784-133-0x00007FFDC58D0000-0x00007FFDC6391000-memory.dmp

    Filesize

    10.8MB

  • memory/2784-134-0x0000000000A80000-0x0000000001A80000-memory.dmp

    Filesize

    16.0MB

  • memory/2784-144-0x000000002F780000-0x000000002F790000-memory.dmp

    Filesize

    64KB

  • memory/2784-145-0x0000000016460000-0x0000000016482000-memory.dmp

    Filesize

    136KB

  • memory/2784-155-0x00007FFDC58D0000-0x00007FFDC6391000-memory.dmp

    Filesize

    10.8MB

  • memory/2784-156-0x000000002F780000-0x000000002F790000-memory.dmp

    Filesize

    64KB

  • memory/6344-157-0x00007FFDC58D0000-0x00007FFDC6391000-memory.dmp

    Filesize

    10.8MB

  • memory/6344-158-0x0000025B8BFF0000-0x0000025B8C000000-memory.dmp

    Filesize

    64KB

  • memory/6344-159-0x0000025B8BFF0000-0x0000025B8C000000-memory.dmp

    Filesize

    64KB

  • memory/6344-169-0x0000025B8BFF0000-0x0000025B8C000000-memory.dmp

    Filesize

    64KB

  • memory/6344-170-0x0000025BA6810000-0x0000025BA6854000-memory.dmp

    Filesize

    272KB

  • memory/6344-171-0x0000025BA6C30000-0x0000025BA6CA6000-memory.dmp

    Filesize

    472KB

  • memory/6344-172-0x00007FFDC58D0000-0x00007FFDC6391000-memory.dmp

    Filesize

    10.8MB

  • memory/6344-173-0x0000025B8BFF0000-0x0000025B8C000000-memory.dmp

    Filesize

    64KB

  • memory/6344-174-0x0000025B8BFF0000-0x0000025B8C000000-memory.dmp

    Filesize

    64KB

  • memory/6344-175-0x0000025B8BFF0000-0x0000025B8C000000-memory.dmp

    Filesize

    64KB