Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 13:15

General

  • Target

    a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe

  • Size

    3.9MB

  • MD5

    e0f5e8b2c0368e6e4634b50a461c46f4

  • SHA1

    9d14972d61544181837feafda360baa07eb73e9f

  • SHA256

    a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894

  • SHA512

    e3d839fadb917454e308578e9b2d8c6a4c137656f357cbbfa02804773ea7f80b0105199f2d05f78cc2c7cba6d5ca140c05de833df6a163facae15c83758780b5

  • SSDEEP

    49152:hSdjhZypyvZOXSyb6qLS7Ex/+0tPpQbwRhd85I8DvMtYEeTat:55jtmkhU88Tat

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe
    "C:\Users\Admin\AppData\Local\Temp\a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -ExecutionPolicy Bypass -File wei-close.ps1 qbittorrent
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nfp2g3k5.mtd.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\wei\status.dat
    Filesize

    12B

    MD5

    ac963522636ece1161192ea4985e9ef6

    SHA1

    9a4309a5e05e38038ff659fc46917d497327291f

    SHA256

    5fabc2d9e049aaf03fb8eb337fe37ddbbca16a754d8534ea4697b6ede858a311

    SHA512

    a6698dc7d7c35fb64007d107654e411c225a7f24bc2e3ba60be9521ff92506199ce0fdfb698922e304c12d56ca18197d609fbc021313883c6d8f7a2a936d62e4

  • memory/1056-11-0x00007FF9A6CD0000-0x00007FF9A7791000-memory.dmp
    Filesize

    10.8MB

  • memory/1056-13-0x000002AD546F0000-0x000002AD54700000-memory.dmp
    Filesize

    64KB

  • memory/1056-12-0x000002AD546F0000-0x000002AD54700000-memory.dmp
    Filesize

    64KB

  • memory/1056-23-0x000002AD546A0000-0x000002AD546C2000-memory.dmp
    Filesize

    136KB

  • memory/1056-26-0x00007FF9A6CD0000-0x00007FF9A7791000-memory.dmp
    Filesize

    10.8MB