Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
19/02/2024, 07:27
General
- Target Injector.exe
- Size 461KB
- Sample240219-jaa19aag51
- SHA256 95b45baa28467be3ca303f48f696990d3491aa9d24ee888d221d5170f7bf5a23
Malware Config
Signatures
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
- Delays execution with timeout.exe 1 IoCs
- Runs regedit.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c timeout 1 & del /F "C:\Users\Admin\AppData\Local\Temp\Injector.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Roaming\regedit.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\regedit.exeC:\Users\Admin\AppData\Roaming\regedit.exe3⤵
- Executes dropped EXE
- Runs regedit.exe
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\8184.tmp.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionExtension "@AppDataDir\regedit.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath ΓÇ£C:\Users\AdminΓÇ¥5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
8184.tmp.bat
__PSScriptPolicyTest_yw1atadv.sdp.ps1
regedit.exe
memory/456-53-0x0000000007CF0000-0x0000000007CF8000-memory.dmp
memory/456-46-0x00000000079D0000-0x00000000079EA000-memory.dmp
memory/456-13-0x00000000032F0000-0x0000000003300000-memory.dmp
memory/456-14-0x0000000005940000-0x0000000005F68000-memory.dmp
memory/456-15-0x00000000056F0000-0x0000000005712000-memory.dmp
memory/456-16-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/456-17-0x0000000006050000-0x00000000060B6000-memory.dmp
memory/456-11-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/456-27-0x00000000060C0000-0x0000000006414000-memory.dmp
memory/456-28-0x00000000066C0000-0x00000000066DE000-memory.dmp
memory/456-29-0x0000000006770000-0x00000000067BC000-memory.dmp
memory/456-30-0x00000000032F0000-0x0000000003300000-memory.dmp
memory/456-31-0x000000007F5D0000-0x000000007F5E0000-memory.dmp
memory/456-33-0x00000000709A0000-0x00000000709EC000-memory.dmp
memory/456-32-0x0000000006CE0000-0x0000000006D12000-memory.dmp
memory/456-43-0x0000000006C30000-0x0000000006C4E000-memory.dmp
memory/456-44-0x00000000078E0000-0x0000000007983000-memory.dmp
memory/456-45-0x0000000008010000-0x000000000868A000-memory.dmp
memory/456-12-0x00000000032F0000-0x0000000003300000-memory.dmp
memory/456-47-0x0000000007A40000-0x0000000007A4A000-memory.dmp
memory/456-48-0x0000000007C50000-0x0000000007CE6000-memory.dmp
memory/456-49-0x0000000007BD0000-0x0000000007BE1000-memory.dmp
memory/456-50-0x0000000007C00000-0x0000000007C0E000-memory.dmp
memory/456-51-0x0000000007C10000-0x0000000007C24000-memory.dmp
memory/456-52-0x0000000007D10000-0x0000000007D2A000-memory.dmp
memory/456-10-0x0000000002D70000-0x0000000002DA6000-memory.dmp
memory/456-56-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/2152-3-0x00000000005A0000-0x000000000069A000-memory.dmp
memory/2152-0-0x00000000005A0000-0x000000000069A000-memory.dmp
memory/3192-86-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/3192-60-0x00000000024D0000-0x00000000024E0000-memory.dmp
memory/3192-58-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/3192-61-0x0000000005480000-0x00000000057D4000-memory.dmp
memory/3192-73-0x00000000024D0000-0x00000000024E0000-memory.dmp
memory/3192-59-0x00000000024D0000-0x00000000024E0000-memory.dmp
memory/3192-74-0x000000007F400000-0x000000007F410000-memory.dmp
memory/3192-75-0x00000000709A0000-0x00000000709EC000-memory.dmp
memory/3956-123-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-121-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-120-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-6-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-122-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-72-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-125-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-124-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-113-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-114-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-115-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-116-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-117-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-118-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/3956-119-0x0000000000910000-0x0000000000A0A000-memory.dmp
memory/4056-100-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/4056-112-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/4056-101-0x00000000709A0000-0x00000000709EC000-memory.dmp
memory/4056-88-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/4056-89-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/4056-87-0x0000000074540000-0x0000000074CF0000-memory.dmp