Analysis

  • max time kernel
    1199s
  • max time network
    1205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-08-2023 21:23

General

  • Target

    installer-package (1).exe

  • Size

    301.9MB

  • MD5

    a4cb9159f165740cd25135322b214df8

  • SHA1

    75f66e71bb86e68b150b6aa5c5f879009841d986

  • SHA256

    4f349e005eb9cebef10044b3f4aa181ea75cf9c107fb0683931397b2ea06a86d

  • SHA512

    77f3f417eb14971db49e064139d124c6ce155361996bc4b85f138a50186114bed6f250bc874a546ed508e57590631355f733073a21d936ac7271870e3510e431

  • SSDEEP

    49152:tK1Ym6zhKavTwucMNDppppppppppppppppppppppppppppppppppppppppppppp7:t3

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops startup file 1 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\installer-package (1).exe
    "C:\Users\Admin\AppData\Local\Temp\installer-package (1).exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:10992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1mm5nfl.l2s.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/556-14-0x000000002F240000-0x000000002F250000-memory.dmp

    Filesize

    64KB

  • memory/556-1-0x00000000008B0000-0x00000000018B0000-memory.dmp

    Filesize

    16.0MB

  • memory/556-11-0x000000002F240000-0x000000002F250000-memory.dmp

    Filesize

    64KB

  • memory/556-12-0x0000000016210000-0x0000000016232000-memory.dmp

    Filesize

    136KB

  • memory/556-13-0x00007FF9C8880000-0x00007FF9C9341000-memory.dmp

    Filesize

    10.8MB

  • memory/556-0-0x00007FF9C8880000-0x00007FF9C9341000-memory.dmp

    Filesize

    10.8MB

  • memory/10992-25-0x0000023EE8B40000-0x0000023EE8B50000-memory.dmp

    Filesize

    64KB

  • memory/10992-24-0x00007FF9C8880000-0x00007FF9C9341000-memory.dmp

    Filesize

    10.8MB

  • memory/10992-26-0x0000023EE8B40000-0x0000023EE8B50000-memory.dmp

    Filesize

    64KB

  • memory/10992-27-0x0000023EE8B40000-0x0000023EE8B50000-memory.dmp

    Filesize

    64KB

  • memory/10992-28-0x0000023EEAE10000-0x0000023EEAE54000-memory.dmp

    Filesize

    272KB

  • memory/10992-29-0x0000023EEB260000-0x0000023EEB2D6000-memory.dmp

    Filesize

    472KB

  • memory/10992-30-0x00007FF9C8880000-0x00007FF9C9341000-memory.dmp

    Filesize

    10.8MB

  • memory/10992-31-0x0000023EE8B40000-0x0000023EE8B50000-memory.dmp

    Filesize

    64KB