Analysis

  • max time kernel
    38s
  • max time network
    48s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18-02-2024 19:34

General

  • Target

    Optimizer-16.4.exe

  • Size

    2.3MB

  • MD5

    9352623ba2fee1206079ce3d81bf0132

  • SHA1

    9c398c2d975d82ba1e46f3bcc0e6298a2b713b8d

  • SHA256

    f4775567ca9941b4fb3224d97b0741ae669eedfcb0d8b3c71106b21bdb1aee28

  • SHA512

    a38cef70819524a3ba8d7583b763da3fac71a9b67e832165f14f60568f7a2a07f67418bb7f7a544b32aa3d76a4fa9a6b142a3998cf362a116171ed4fae05187e

  • SSDEEP

    24576:QqsJmQYTZZ4GKTnbv7DO9JvvEC8ZJC3Bjk38WuBcAbwoA/BkjSHXP36RMG:QMH4VTnbv7uEC8Zw3CSA/Bkj0

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Optimizer-16.4.exe
    "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Optimizer\Optimizer.log

    Filesize

    295B

    MD5

    8cf9a7af54b02e8bb48addad12b0eea6

    SHA1

    e9995f0ec08cf0974b0a6f567afc1b7fece78893

    SHA256

    4b95b944f85fa83522c726b5e189a7a6bccdbcec30d1c71dd7d0dc6470f14d10

    SHA512

    228878b4530d965cc827058b3d31787ed6865750996edd4dd1aee15b9fb34f1650d686c2bb068930d4368c0363abd9974a19b9ab271ab9de80b19391c3632719

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pwwpc4ak.uw4.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/3308-25-0x00000209BF250000-0x00000209BF272000-memory.dmp

    Filesize

    136KB

  • memory/3308-32-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB

  • memory/3308-24-0x00000209BFAB0000-0x00000209BFB26000-memory.dmp

    Filesize

    472KB

  • memory/3308-0-0x00000209A4A60000-0x00000209A4CB8000-memory.dmp

    Filesize

    2.3MB

  • memory/3308-27-0x00000209BF2E0000-0x00000209BF2FE000-memory.dmp

    Filesize

    120KB

  • memory/3308-28-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB

  • memory/3308-29-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB

  • memory/3308-30-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB

  • memory/3308-31-0x00007FF8FF520000-0x00007FF8FFFE2000-memory.dmp

    Filesize

    10.8MB

  • memory/3308-3-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB

  • memory/3308-33-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB

  • memory/3308-34-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB

  • memory/3308-35-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB

  • memory/3308-2-0x00000209BF1A0000-0x00000209BF252000-memory.dmp

    Filesize

    712KB

  • memory/3308-50-0x00000209C2280000-0x00000209C229C000-memory.dmp

    Filesize

    112KB

  • memory/3308-51-0x00000209C22A0000-0x00000209C22AA000-memory.dmp

    Filesize

    40KB

  • memory/3308-52-0x00000209C2310000-0x00000209C2336000-memory.dmp

    Filesize

    152KB

  • memory/3308-1-0x00007FF8FF520000-0x00007FF8FFFE2000-memory.dmp

    Filesize

    10.8MB

  • memory/3308-68-0x00000209C29B0000-0x00000209C29C2000-memory.dmp

    Filesize

    72KB

  • memory/3308-70-0x00000209BF320000-0x00000209BF330000-memory.dmp

    Filesize

    64KB