1079a613057f32e18e2f94db6e6451bb83eff68771297aeb8bc11919085c52a0

Analysis

max time kernel
1680s
max time network
1151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KinitoPET.v1.1.0-P2P/KinitoPET/extra/off.bat
Size 287B
Sample240302-q5efgsec53
SHA256 672e4954da1ad7dfd19cacc1f41ecf3e9ab4e1d45d8b095f5b23d3bfe568532a
MD5 03889252d52ac087c568af4986b50dda
SHA1 ea5b819dcf06110180301911bb41ab91c7d29dd6
SHA512 c8ee7670b0ddc3ed1ba549956dbd411ec21518db49729215b0b6acab1c1cc03ff4d7f053a21afe032c770c75e69ff92175d7b2b623d81d5c2318567256d006b4
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
452	powershell.exe
452	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 452	1968	cmd.exe	89
PID 1968 wrote to memory of 452	1968	cmd.exe	89
PID 452 wrote to memory of 5116	452	powershell.exe	90
PID 452 wrote to memory of 5116	452	powershell.exe	90
PID 5116 wrote to memory of 1044	5116	csc.exe	91
PID 5116 wrote to memory of 1044	5116	csc.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KinitoPET.v1.1.0-P2P\KinitoPET\extra\off.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -command $obj = Add-Type -MemberDefinition '[DllImport(""""user32.dll"""")] public static extern int SendMessage(int hWnd, int hMsg, int wParam, int lParam);' -Name fn -Namespace ns -PassThru; $obj::SendMessage(0xffff, 0x0112, 0xF170, 2)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ublhpxdk\ublhpxdk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5157.tmp" "c:\Users\Admin\AppData\Local\Temp\ublhpxdk\CSCBE9F61F1CAB347A8A9FD8F9B4DC21D5F.TMP"
      4⤵
      PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES5157.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5157.tmp
Size 1KB
SHA256 72f32bb3ed0632fcffddaaa050d0ce923088f77612f82cd6df9cd264feb8e491
MD5 bb532982dc4a138bd7e1532f740b7c72
SHA1 ddfb8782fc23fde05d9e0a8ca7abc2a376ff005a
SHA512 de611f7c50a3f606995a11f361928b71e25083e213ce5477a4ffa9622db2407319a6c77090cb0b7316c61ca09fdd7eb2021832e90a1bf944982bd81bbcc39e88
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_mwy4zkzp.53g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mwy4zkzp.53g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ublhpxdk.dll

Path C:\Users\Admin\AppData\Local\Temp\ublhpxdk\ublhpxdk.dll
Size 3KB
SHA256 5ba40d8fdb0422e8a6fec31dc21457f48a08ee94e563db03eb5fbf04c2908941
MD5 8be36709f41e4212c1b219b965f3930d
SHA1 6ef5b87891616a25eb03d7b4a171f6458a81b5fc
SHA512 0f37f279af757f89ec0e7782a0c51656b8f85e544ebc891165649523f5dae6f92235d87c191f3fa570ecac9ed71604b2c1a321024940582191c8b64d9d51fab7
MD5 SHA1 SHA512

Submit Download

CSCBE9F61F1CAB347A8A9FD8F9B4DC21D5F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ublhpxdk\CSCBE9F61F1CAB347A8A9FD8F9B4DC21D5F.TMP
Size 652B
SHA256 c1b66480facca384e7540e6163e89fcbfd3ad4f2fc4db99a85ccae064329e26f
MD5 3d7da6cc83c2b0d2e2c2d1441e4d7e86
SHA1 c1d3e2db42009be0f3c4ef3b3e5c3c155b5f1ebf
SHA512 2abb4016f76f9e2034f780565791ef3e3671a37edab88d7b6189bdd3c9e9705eb1d3ab36bebd669c3fdd8987ca4de52ccb61b4e92e482ef1682b9ab7948a86c9
MD5 SHA1 SHA512

Submit Download

ublhpxdk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ublhpxdk\ublhpxdk.0.cs
Size 219B
SHA256 647a20a516bd6c1bf672137cf2d092312b74deb1dbebd1156b6fda2051d1728e
MD5 b04c2616c36a0888c636a79e26cb5db8
SHA1 2498cd3bcba70b4f562f3dfb8be120b494628a29
SHA512 fa62f60a5c0797e7d077b275592ef91af84e4d810b053f3da1ae08c84dc1037f9ebbe89b691e7ffa387e19ddb09c9c927a3cdfa9232a1a0c2c83db1f45b55f88
MD5 SHA1 SHA512

Submit Download

ublhpxdk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ublhpxdk\ublhpxdk.cmdline
Size 369B
SHA256 6f18d2a892e8bfe25d8747d060ed9cf90f9d65159ddef4bb9fb9602e17be3174
MD5 34115b30999e0e7272dc49be15645870
SHA1 46318fc58161c46441107776560a1ad3b2c11a76
SHA512 c0a07d2b7a7ddedada72162ec3cc807d3cb1118790eab58bc9ae34f16a9edae8bf9612b214970d609de2bdab629b387d2c28b216c2da4f797c22cedfb2852bef
MD5 SHA1 SHA512

Submit Download

memory/452-0-0x000002D7370F0000-0x000002D737112000-memory.dmp

Download

memory/452-10-0x00007FFD7E6D0000-0x00007FFD7F191000-memory.dmp

Download

memory/452-11-0x000002D71CE70000-0x000002D71CE80000-memory.dmp

Download

memory/452-12-0x000002D71CE70000-0x000002D71CE80000-memory.dmp

Download

memory/452-25-0x000002D737480000-0x000002D737488000-memory.dmp

Download

memory/452-29-0x00007FFD7E6D0000-0x00007FFD7F191000-memory.dmp

Download