Resubmissions

17-02-2024 23:23

240217-3db79scb75 3

17-02-2024 05:08

240217-fsz7baca54 10

Analysis

  • max time kernel
    67s
  • max time network
    82s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-en
  • resource tags

    arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17-02-2024 05:08

General

  • Target

    0x000a000000023656-53.exe

  • Size

    686.9MB

  • MD5

    3abe8b51f5087787b9c121b10f37108b

  • SHA1

    4cb1fc54dc24f175c744a958e74ff84b5fb16d4e

  • SHA256

    7ba93fe544def71fa435ae70911356845d19d5fcee1df71369aa537fe848c5d5

  • SHA512

    fcee37f1e56aed457f71aa0c54f320e28a308c002d639bcd424389cb464ce18103746b470456f5824b28d079cead670bdcb8d691d8bed864544ffbfe2c75fed4

  • SSDEEP

    1572864:jnhUzyh7u4k9pJmoLKAwhzTICA8VjcDJSx:jnikUDUzPAUj3x

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000a000000023656-53.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000a000000023656-53.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iaor30gk.lbu.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • memory/4260-7-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/4260-5-0x0000000030A10000-0x0000000030BB4000-memory.dmp

    Filesize

    1.6MB

  • memory/4260-202-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/4260-4-0x00000000306D0000-0x0000000030762000-memory.dmp

    Filesize

    584KB

  • memory/4260-1-0x0000000000F20000-0x0000000001F20000-memory.dmp

    Filesize

    16.0MB

  • memory/4260-6-0x0000000030840000-0x000000003084A000-memory.dmp

    Filesize

    40KB

  • memory/4260-0-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/4260-8-0x0000000046940000-0x00000000469A6000-memory.dmp

    Filesize

    408KB

  • memory/4260-9-0x0000000046EA0000-0x0000000046F3C000-memory.dmp

    Filesize

    624KB

  • memory/4260-10-0x0000000030850000-0x0000000030860000-memory.dmp

    Filesize

    64KB

  • memory/4260-2-0x0000000030850000-0x0000000030860000-memory.dmp

    Filesize

    64KB

  • memory/4260-3-0x0000000030D60000-0x000000003125E000-memory.dmp

    Filesize

    5.0MB

  • memory/4620-16-0x0000000004600000-0x0000000004610000-memory.dmp

    Filesize

    64KB

  • memory/4620-15-0x0000000004600000-0x0000000004610000-memory.dmp

    Filesize

    64KB

  • memory/4620-14-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/4620-13-0x00000000069F0000-0x0000000006A26000-memory.dmp

    Filesize

    216KB

  • memory/4620-19-0x0000000007810000-0x0000000007876000-memory.dmp

    Filesize

    408KB

  • memory/4620-20-0x0000000007AF0000-0x0000000007E40000-memory.dmp

    Filesize

    3.3MB

  • memory/4620-21-0x0000000007E70000-0x0000000007E8C000-memory.dmp

    Filesize

    112KB

  • memory/4620-72-0x00000000091C0000-0x0000000009236000-memory.dmp

    Filesize

    472KB

  • memory/4620-41-0x0000000008F00000-0x0000000008F3C000-memory.dmp

    Filesize

    240KB

  • memory/4620-18-0x0000000007770000-0x0000000007792000-memory.dmp

    Filesize

    136KB

  • memory/4620-17-0x0000000007060000-0x0000000007688000-memory.dmp

    Filesize

    6.2MB

  • memory/4620-77-0x000000000A390000-0x000000000AA08000-memory.dmp

    Filesize

    6.5MB

  • memory/4620-78-0x0000000009D50000-0x0000000009D6A000-memory.dmp

    Filesize

    104KB

  • memory/4620-79-0x0000000004600000-0x0000000004610000-memory.dmp

    Filesize

    64KB

  • memory/4620-120-0x0000000004600000-0x0000000004610000-memory.dmp

    Filesize

    64KB

  • memory/4620-200-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/4620-22-0x0000000007ED0000-0x0000000007F1B000-memory.dmp

    Filesize

    300KB