Analysis

  • max time kernel
    117s
  • max time network
    140s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/02/2024, 10:15

General

  • Target

    data/AppInfo/services/data/Launcher.exe

  • Size

    364KB

  • MD5

    fea10d11d84919cb9a0a0752d61c0a66

  • SHA1

    aea3c65e2b62851b2dd112597f28379b49c58a0a

  • SHA256

    2786febdd57874118eaf5e257382cf4467d43f9ca189ac48ff6d45494f1cbab7

  • SHA512

    e382f79ec1f1c370cd0053cccc7a0db8f3dc28b22f9dacd5f425c60adfb21e4a6eed3e119a7f9bbf135839e22d46511ca793cf8b5118d0e6256ebbbe749fc508

  • SSDEEP

    6144:LpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrZR5lJWPkOD:Lp8KLBzQ7Lcf3SiQs2FTTql9unNrkvzw

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\data\AppInfo\services\data\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\data\AppInfo\services\data\Launcher.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
      2⤵
        PID:3564

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nyf2y54q.0jq.ps1

            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • memory/216-12-0x0000000007AD0000-0x0000000007B1B000-memory.dmp

            Filesize

            300KB

          • memory/216-4-0x0000000006750000-0x0000000006760000-memory.dmp

            Filesize

            64KB

          • memory/216-3-0x0000000072590000-0x0000000072C7E000-memory.dmp

            Filesize

            6.9MB

          • memory/216-6-0x0000000006D90000-0x00000000073B8000-memory.dmp

            Filesize

            6.2MB

          • memory/216-7-0x0000000006B10000-0x0000000006B32000-memory.dmp

            Filesize

            136KB

          • memory/216-8-0x00000000074C0000-0x0000000007526000-memory.dmp

            Filesize

            408KB

          • memory/216-9-0x0000000006CB0000-0x0000000006D16000-memory.dmp

            Filesize

            408KB

          • memory/216-10-0x00000000075F0000-0x0000000007940000-memory.dmp

            Filesize

            3.3MB

          • memory/216-11-0x0000000007530000-0x000000000754C000-memory.dmp

            Filesize

            112KB

          • memory/216-30-0x000000007E570000-0x000000007E580000-memory.dmp

            Filesize

            64KB

          • memory/216-5-0x0000000006750000-0x0000000006760000-memory.dmp

            Filesize

            64KB

          • memory/216-13-0x0000000007D20000-0x0000000007D96000-memory.dmp

            Filesize

            472KB

          • memory/216-2-0x00000000029E0000-0x0000000002A16000-memory.dmp

            Filesize

            216KB

          • memory/216-31-0x0000000008DA0000-0x0000000008DD3000-memory.dmp

            Filesize

            204KB

          • memory/216-32-0x0000000070FB0000-0x0000000070FFB000-memory.dmp

            Filesize

            300KB

          • memory/216-33-0x0000000008D80000-0x0000000008D9E000-memory.dmp

            Filesize

            120KB

          • memory/216-38-0x0000000008DE0000-0x0000000008E85000-memory.dmp

            Filesize

            660KB

          • memory/216-39-0x0000000006750000-0x0000000006760000-memory.dmp

            Filesize

            64KB

          • memory/216-40-0x00000000090A0000-0x0000000009134000-memory.dmp

            Filesize

            592KB

          • memory/216-233-0x0000000006870000-0x000000000688A000-memory.dmp

            Filesize

            104KB

          • memory/216-238-0x0000000006860000-0x0000000006868000-memory.dmp

            Filesize

            32KB

          • memory/216-254-0x0000000072590000-0x0000000072C7E000-memory.dmp

            Filesize

            6.9MB