06b506b62dfb4e6e797641ddacbafcce859ed573c9e3a90188ee8c62de03903a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a5da7c997fc71652fd9aeb1dc83372a.exe
Size 4.1MB
Sample240108-eedwgsafbk
SHA256 06b506b62dfb4e6e797641ddacbafcce859ed573c9e3a90188ee8c62de03903a
MD5 4a5da7c997fc71652fd9aeb1dc83372a
SHA1 8b23e5a0ad4343d61d76deef97aab15376251bc5
SHA512 e0c14cf0b730790fb8e938026a829cb3249d324570136a6b208dda868deb8f839216a34df325710bc2f161987879984db31248a1998c12457dcfaf02931ab0b9
SSDEEP 98304:jmq2QVrg7qmpoMkpaflYTLy8aO8rydaNpSVMsaHp:NndgumpoMkpckASesC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2396	tasklist.exe
3628	tasklist.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1000	powershell.exe
1000	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	2396	tasklist.exe
Token: SeDebugPrivilege	3628	tasklist.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 3580	448	4a5da7c997fc71652fd9aeb1dc83372a.exe	89
PID 448 wrote to memory of 3580	448	4a5da7c997fc71652fd9aeb1dc83372a.exe	89
PID 448 wrote to memory of 3580	448	4a5da7c997fc71652fd9aeb1dc83372a.exe	89
PID 3580 wrote to memory of 4824	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	92
PID 3580 wrote to memory of 4824	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	92
PID 3580 wrote to memory of 4824	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	92
PID 4824 wrote to memory of 1000	4824	cmd.exe	94
PID 4824 wrote to memory of 1000	4824	cmd.exe	94
PID 4824 wrote to memory of 1000	4824	cmd.exe	94
PID 3580 wrote to memory of 3264	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	106
PID 3580 wrote to memory of 3264	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	106
PID 3580 wrote to memory of 3264	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	106
PID 3264 wrote to memory of 3988	3264	cmd.exe	101
PID 3264 wrote to memory of 3988	3264	cmd.exe	101
PID 3264 wrote to memory of 3988	3264	cmd.exe	101
PID 3988 wrote to memory of 2396	3988	cmd.exe	100
PID 3988 wrote to memory of 2396	3988	cmd.exe	100
PID 3988 wrote to memory of 2396	3988	cmd.exe	100
PID 3580 wrote to memory of 2344	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	103
PID 3580 wrote to memory of 2344	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	103
PID 3580 wrote to memory of 2344	3580	4a5da7c997fc71652fd9aeb1dc83372a.tmp	103
PID 2344 wrote to memory of 800	2344	cmd.exe	105
PID 2344 wrote to memory of 800	2344	cmd.exe	105
PID 2344 wrote to memory of 800	2344	cmd.exe	105
PID 800 wrote to memory of 3628	800	cmd.exe	104
PID 800 wrote to memory of 3628	800	cmd.exe	104
PID 800 wrote to memory of 3628	800	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\4a5da7c997fc71652fd9aeb1dc83372a.exe
"C:\Users\Admin\AppData\Local\Temp\4a5da7c997fc71652fd9aeb1dc83372a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Local\Temp\is-CAIQR.tmp\4a5da7c997fc71652fd9aeb1dc83372a.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CAIQR.tmp\4a5da7c997fc71652fd9aeb1dc83372a.tmp" /SL5="$130028,3352353,56832,C:\Users\Admin\AppData\Local\Temp\4a5da7c997fc71652fd9aeb1dc83372a.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-O5J5R.tmp\ex.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
      4⤵
      Suspicious use of WriteProcessMemory
      PID:800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3264

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
1⤵
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_1velcjon.1xj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1velcjon.1xj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

4a5da7c997fc71652fd9aeb1dc83372a.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CAIQR.tmp\4a5da7c997fc71652fd9aeb1dc83372a.tmp
Size 691KB
SHA256 bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
MD5 9303156631ee2436db23827e27337be4
SHA1 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA512 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
SSDEEP 12288:7QszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9by7HaOMe3mxyF:7QQP8YXpc/rPx37/zHBA6plp+51CErzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-O5J5R.tmp\CheckProc.cmd
Size 128B
SHA256 ca1bf4fe8a59a31f06a4f2d975671fbb2eeca33d40b0c35318f2131a118754cf
MD5 dae8768bbb8a4fddc4dca8eae7c4d65f
SHA1 385ffb932fcff489392536d62e291ed9e0beea98
SHA512 492feada84b7064547bd6d22ed13cf6949156eb3daa9af5aa9c3da44dd6ac7e540904c494de14a7858d498944ab51c7525caac3c9aa933d1e55ca35442c075b6
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-O5J5R.tmp\CheckProc.cmd
Size 128B
SHA256 e9f9690b327cf24e6c260f93232dd4b961d82a709c16589ba72aabcdba0c039c
MD5 6a745081c62a706c014a876f45b5a56b
SHA1 25f17fcc50dd202d2381c00970e2dc04c2ad9707
SHA512 a420efa894ef6fedad4fafd5e15042f947ff96a169031b7299afeba797bcaefa675508f72f57bfa8452a35d61314a544e26bc535ddb61a0cdfdca03c07ae372f
MD5 SHA1 SHA512

Submit Download

av.txt

Path C:\Users\Admin\AppData\Local\Temp\is-O5J5R.tmp\av.txt
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

ex.bat

Path C:\Users\Admin\AppData\Local\Temp\is-O5J5R.tmp\ex.bat
Size 786B
SHA256 e95dcc681e9bade0a0248b8e116b11dbca8fe86f79fb4db2c8e5c2e4e166c1c7
MD5 bbb4e6e796e6889dabffdf649a9211a7
SHA1 4c58e711be8e49fb2976c1988152a7b3d0d00c8e
SHA512 14b7de515334342ab47051f9b4d756dd569f4086575fbaf9c5a6e7be3d12dcd36a2965de3e726d4a50d495c368e973ad7cc76cf25061de2928f40b15621d1442
MD5 SHA1 SHA512

Submit Download

memory/448-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/448-52-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/448-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1000-19-0x0000000005320000-0x0000000005386000-memory.dmp

Download

memory/1000-35-0x00000000065C0000-0x00000000065E2000-memory.dmp

Download

memory/1000-30-0x0000000005BE0000-0x0000000005F34000-memory.dmp

Download

memory/1000-17-0x0000000005440000-0x0000000005A68000-memory.dmp

Download

memory/1000-18-0x00000000051C0000-0x00000000051E2000-memory.dmp

Download

memory/1000-31-0x0000000006060000-0x000000000607E000-memory.dmp

Download

memory/1000-32-0x00000000060A0000-0x00000000060EC000-memory.dmp

Download

memory/1000-33-0x0000000006610000-0x00000000066A6000-memory.dmp

Download

memory/1000-34-0x0000000006570000-0x000000000658A000-memory.dmp

Download

memory/1000-20-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Download

memory/1000-36-0x00000000078D0000-0x0000000007E74000-memory.dmp

Download

memory/1000-37-0x0000000008500000-0x0000000008B7A000-memory.dmp

Download

memory/1000-40-0x0000000073530000-0x0000000073CE0000-memory.dmp

Download

memory/1000-14-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

Download

memory/1000-15-0x0000000073530000-0x0000000073CE0000-memory.dmp

Download

memory/1000-16-0x0000000004E00000-0x0000000004E10000-memory.dmp

Download

memory/3580-7-0x0000000000650000-0x0000000000651000-memory.dmp

Download

memory/3580-51-0x0000000000400000-0x00000000004BD000-memory.dmp

Download