Malware Analysis Report

2024-10-23 17:19

Sample ID 240304-wgaqaahg55
Target Photoshop.exe
SHA256 d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d
Tags
povertystealer stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d

Threat Level: Known bad

The file Photoshop.exe was found to be: Known bad.

Malicious Activity Summary

povertystealer stealer

Detect Poverty Stealer Payload

Poverty Stealer

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Enumerates physical storage devices

Views/modifies file attributes

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-04 17:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-04 17:53

Reported

2024-03-04 17:55

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"

Signatures

Detect Poverty Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Poverty Stealer

stealer povertystealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1996 set thread context of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\Photoshop.exe C:\Windows\system32\cmd.exe
PID 2184 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\Photoshop.exe C:\Windows\system32\cmd.exe
PID 2184 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\Photoshop.exe C:\Windows\system32\cmd.exe
PID 2184 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\Photoshop.exe C:\Windows\system32\cmd.exe
PID 2548 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2548 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2548 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2548 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2576 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2576 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2576 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2476 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2476 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2476 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2440 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2440 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2440 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2908 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2908 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 2908 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2548 wrote to memory of 1848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2548 wrote to memory of 1848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2548 wrote to memory of 1848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2548 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
PID 2548 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
PID 2548 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
PID 2548 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1996 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Photoshop.exe

"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p125762329330388294023250819845 -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_5.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_4.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_3.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "nmYIeCI7gcMH.exe"

C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe

"nmYIeCI7gcMH.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 joxi.net udp
US 104.21.73.118:80 joxi.net tcp
US 104.21.73.118:443 joxi.net tcp
DE 146.70.169.164:2227 tcp

Files

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 12b875e85a885c81bc04161e9df9151a
SHA1 7d9e32a575e487611abb182b4d89b1ab4f4e7a06
SHA256 97e80e083ba83a031bb03097cd81d86708165cd7eb1c070782e6a7234de784a5
SHA512 3ba38a4024287bcaeee208a1c0158fae73a86d5581cf566309985bbd204e810eb5fd099a1816a9326c9e25bb08a2da20f2a4884978eb4e4ed8a3762c1057d0ca

C:\Users\Admin\AppData\Local\Temp\main\file.bin

MD5 afaebf70e6daf7bf2e07cd11f93ee4a1
SHA1 4e8b08b3e50f860955bd00d16fc1653c07b7c608
SHA256 4a9d76fb9d77efaf81616e750b928ba3955599acafb2c0fec0d7ce412db0f47b
SHA512 4db3a63f03f8816b85fdb905e2a2f08967f9f3735206f08f2cae8b8cd561e8563d2f92c188d32b94fdb6d472e07c5f41f54e26673f8a81449454225220ba397f

\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

MD5 9e57c6bb6dfb456cd9907844b7afafbd
SHA1 daee76439ed4cd77192dc5c2d52b187f18e5ba99
SHA256 729dbb0bd855dc1c1cf59366f49e29cb2b6e0d1279270924d2b131d7df749eab
SHA512 3a99dae0a7c4ac47c5143dd6ada9a485cf115d3d9b172c3ba6d0847d6848e41defccd3a4eaf1b44c3ae46820c2164127b4e1ceaa5e07a8028e9b38f823a5960b

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

MD5 4ab6b1ed8f26df37c531a80147982511
SHA1 25d59710197c30eee836096dfcce139ba84f978a
SHA256 33f73488015443cc05fa02d1c0723921502de5cac3206cf9fc433472a2afb162
SHA512 a582e4cd93baf45b48aad086ffc5edab4ec899cbd029e9e740e93cf34a2aff492f14c92ed2efc0339fc4eed979311600007fca3075abda28232d9d351dd49e24

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

MD5 210ee7f34c0ff268d33d598a49eb889a
SHA1 876dea438f3f365513159630a12a2192fecd8b7f
SHA256 9d8ee7edf36676633d624774cb194a45ef8ae286cb5e9591d46c20be57a9282f
SHA512 383bb66f996b858d4ef23eed2264c4f890d47aca7b3da88587e3bb6454183f8d35e44411b08eecafe3fbb0638610cd872d1d00402dd8ff0b660102a44b53bcb1

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

MD5 763cb011f068f184a672e254d3ce3c39
SHA1 59eb148e6ad321cac5396e6a58c1528f7932befb
SHA256 d25782f4a9573c40747458b6916e9332b34a349b3011ec85dd5d11a583a87105
SHA512 530b8c0ad90b53f38cd56ffaf3766f33167c9922e55f8485ca87019275730c94dd6a84a1d9578163c45bae2743cf6981041f9ccc97ceb822f8d607f94a0c1d28

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

MD5 5f79b89dbaf23387caa818b0da7b8ea2
SHA1 3c38d94819331fd551c07048841cfe6ecbf29e18
SHA256 7abc58d9dd3dee48f88629c8dcaf12e72a337f8bf1dbce59d464ab6ed698b726
SHA512 a6381f3b0d3184ab098e9a40ca65dd1cec76cb7e0cfe13a5c2d188e4c8e6d077286c70a366ad6ffc7e7f68faa6240a730b7034fcaa00d1c1f0922e42c1edb8fc

C:\Users\Admin\AppData\Local\Temp\main\extracted\nmYIeCI7gcMH.exe

MD5 53c6cf5bf9ce4922b3dc9bf9cc2374a2
SHA1 b9a0d229a47fadaaa0898d32dce3aac279ac8569
SHA256 2bb1a0a95249e3bcca1fdfc740bc91df10dc9c8cd834707a0b5a31883eb6867e
SHA512 d323cfdfc3db5c5ce70ba572c0c657def11c3b36703a029977f5c5ddfdb278dfd1eea8950686d7a566dcd550aa0c854ceb035e6e67fcb377a8fc50dc4e0cd64c

C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

MD5 47e8ed572da00474326b4cee8f85b005
SHA1 94bceabdc880c41d73d6c984a9d61c31dd29ce91
SHA256 abd52eb132c8c23669233a656f036a0e07692efd398894b724b61b66a75564af
SHA512 31da04b57f0ef1b3363a3fa4855ca576d9159d374de0d2d9defb5524e67fed740441dcc2245a246daecab6260a419c02a32770ee9be53a2ddbede9dd4848d624

memory/2268-84-0x0000000000090000-0x000000000009A000-memory.dmp

memory/1996-83-0x0000000000520000-0x0000000000620000-memory.dmp

memory/2268-86-0x0000000000090000-0x000000000009A000-memory.dmp

memory/2268-94-0x0000000000090000-0x000000000009A000-memory.dmp

memory/2268-91-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2268-96-0x0000000000090000-0x000000000009A000-memory.dmp

memory/2268-95-0x0000000000090000-0x000000000009A000-memory.dmp

memory/2268-99-0x0000000000150000-0x0000000000151000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-04 17:53

Reported

2024-03-04 17:55

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"

Signatures

Detect Poverty Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Poverty Stealer

stealer povertystealer

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Photoshop.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3364 set thread context of 3048 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5108 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\Photoshop.exe C:\Windows\system32\cmd.exe
PID 5108 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\Photoshop.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 4768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 4576 wrote to memory of 4768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 4576 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 3572 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 3572 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 4604 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 4604 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 1304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 1304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4576 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4576 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4576 wrote to memory of 3364 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
PID 4576 wrote to memory of 3364 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
PID 4576 wrote to memory of 3364 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
PID 3364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Photoshop.exe

"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p125762329330388294023250819845 -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_5.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_4.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_3.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "nmYIeCI7gcMH.exe"

C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe

"nmYIeCI7gcMH.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 joxi.net udp
US 104.21.73.118:80 joxi.net tcp
US 104.21.73.118:443 joxi.net tcp
US 8.8.8.8:53 118.73.21.104.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 12b875e85a885c81bc04161e9df9151a
SHA1 7d9e32a575e487611abb182b4d89b1ab4f4e7a06
SHA256 97e80e083ba83a031bb03097cd81d86708165cd7eb1c070782e6a7234de784a5
SHA512 3ba38a4024287bcaeee208a1c0158fae73a86d5581cf566309985bbd204e810eb5fd099a1816a9326c9e25bb08a2da20f2a4884978eb4e4ed8a3762c1057d0ca

C:\Users\Admin\AppData\Local\Temp\main\file.bin

MD5 0429f9dcdaaa3759bbeab48a061ba2f5
SHA1 5c6789c6f98e2c229d7346a721374145e79fcd84
SHA256 45f172657395a9e208a831e486a03dfc364299f554945eb2784a8fd8feb83af9
SHA512 9ec18ffa680907eea44db8f9a7abb83a8d16cee8aa53cc5841615b72d9b07abb2ebf8a6ac449b2b40b9ee3c6176d04f6240d1fb302121e9e20afda6dc6acabaa

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 cf8f73fbdb9778ac2f3a87c26c1b2375
SHA1 6f06ad0fa73e2dae3cf993d4a2f93f3fc3437fa4
SHA256 c12b0d088168d33679234472f7fe895fe3aa8bf97194a4fc12337e13ec048fc2
SHA512 8b880efe108033704fc6ba58239adf278d62850f6f53d2c07417785e9edfa7bad504d138268278371c0234c6164cea54c15f1bdc2b67975b57427912e7240731

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 27899c7e34ec13e0635897a95989d8b1
SHA1 8d0f408c2ca321ce84262b47b22bc7dd25fe66f9
SHA256 527bd290ee5eb72fcb055d559e5ba9e19a4ec358ecbd93fc518436b4a7ce8c1f
SHA512 7e2a4555807b956b3b8f348fc41285f8c4f42e71e5eb542fdc0c8da99c67eae262e65b0ebcad5b1eaaa25206923442e0ccc995372802ed60bb743464c18587eb

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 dca2240336bda6fe85a6888a0fe27a29
SHA1 26c6708a40e6158e6e8a450fed3b4feaa5ea6d1f
SHA256 e01188cf8beeb123713231d2659cc984b6f83388cb0bd174cbce30e9dfff7352
SHA512 90c63d60b4c452f162ee408aeec462b31d14374a4b1fd290d66afede5a84fd1dbd814481dce4cfffbcbea1645f9c61a6f4de8f6789343a5d379d8408842d8719

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 a99911883cae967df3b7f5ed647e10b4
SHA1 c1fe4151c757686cc97ff179ccca99c4c95dbd9a
SHA256 a58dda617ec1c3905c3ff6d1dae6840323d7204a443da622dc6ef93525994b6a
SHA512 eef3756b542644f71c12bee1a3bff9b265c9760fa8b625cf5fcaa283136447c6c8a6c69cbf21c44928bd95aa16a90b662a8d3cafd33004107d85fbb6b8ff8d71

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

MD5 2b326ac638b75230726c77027f6595d0
SHA1 25860e9508cddd436c51a542952f362a67a7f27e
SHA256 c37dbbeaa315d4807253bf2264c93c53eec86cbf90fb68d86eef4224bdc14e93
SHA512 dab7fdd91c7e1e1e1ed0a97c23a4427094ea1f56d7728e3f8fbf66f14d2bb9ea7a779b4e7138449ba3ce44a0f7392f45967afac6b16aea174145ecd84735bd2a

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 dafc2c93ce7ad760afe716d1d6ec529f
SHA1 f6b0bbbd18a0308dc654fdda45951e5bff4effd0
SHA256 85abcd9478eb7d5378777bbe1d822c7e99caeda3b573004ea558f5e86217b4f7
SHA512 b4cdada74e64f9b80ff39713b1fafe5ba78bb193d853ba45913d94ed5a58098b4054c7b43fa5be8f1a6cebcaa36a30a8ac05099c1b18155615bf45f91b2ea31b

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

MD5 1baeffbbf9b5f4a6ee0fd0c06a1b5363
SHA1 54cf2a6961b1959cadec6f6f83b4362187e4c945
SHA256 25ee3383afc1b2680ac955e48302c1339fbe476ba09645d1c020db3cfec5c4f0
SHA512 87b9e5d200f25e4ae7cfb9ba149628d2575fcff2e4612a177be66875586635ab5c68b0297d2c849440e5f3286f5baf6dfd4d77e3510116a6ff26ef869862b6fd

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 c811af8d98ea4e2a5014e1a7a4f05ce4
SHA1 81823845912a6db727d1d600fbb4c62ba8fcfdce
SHA256 89c574b0be1be5b04143d38e67ad62a7a145ca9c78715998900692e346ec1ade
SHA512 fe22d5fa1fc64f70649cdb7f3c87e1c40ce249764faab88a145f201368ab8677c0d5d067e39f007ca5d8b3e4ff101215845f05f43b0350ddc76136c116e7d542

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 7db3fe4b589fded752ca752f164b3e5d
SHA1 844f222bda00d1922119be0cecfbefee34302adb
SHA256 47cd7460a2dfd9f046ee506b588bb57945ddb7174500409c12bc1956fcd1d276
SHA512 90152919bc1b7ef60bba05fc0d663e117f15bece41f20f4e308256bc04c6a73f1bd022a5a5d0c1de782b3bf74e04839181e2008692000825783f2418fc482c18

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 faf6c0b1090d81f3dd331fc4264a5f76
SHA1 7495f0cf3651fd040597e2310915a8a19051a63e
SHA256 c9a07307cdf9696ac62c5eadcc962352ee07946df558ed7f46ff2d1044304eb5
SHA512 9c07f3ed55e88c338b268661d1f75ee213f1af0405f92afb4f375f61ec7eeac554fef0cac836ea616a6a58f479d35ce20d314f6f26e2f53f3b04772189a2ab25

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 61278241730c6c45cf32245e5702d6b2
SHA1 be07c9fbf50632a5bbf11a32312d5484f427f3b2
SHA256 3c4767376fab655c33247c27b6dab66386ccdb945e4dc3c94801e980044b60c8
SHA512 b9e5196e9618f752cd5b3775a76fb6a4fed2a64b3cb2e4a59db4493a2fb0d5c8c538efd4453ba55f050466adba0ad031a155caa91b60b3ed86890115fc424de4

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

MD5 cd86595c79ed4866ac6f03c3de4ccc20
SHA1 16c62317fdd82d79c83dfd17ec7e3b70447b650b
SHA256 38337840bd7cd036191adf82037c7f7f8b85e171621df7f419d9ed4d44530d8b
SHA512 fb7c841bdb44d08e1fd8fa8ffc7e5202c4db67bc6f365a419474c1ad0679af631ffea8a83f1d1f1c9b78192b6342358ebc66100372a02fec42aa736561f957a0

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

MD5 4744ed1bf557cc1a7aa611aba426d7b2
SHA1 19818e8663797a7ff48e71e3440413695f134d0e
SHA256 631d26e9296d09ba9be06bfa0b8719d3a233cc485b8be07320ffb02eba7bed30
SHA512 dce17fa5ae60addf52cd62478548ab7dd079def45f350557e1996702ac0aa426ceedf1c73298038d044ac5ece2ba8538383b9177db93e34a9a157bb758471b83

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 cd3c0b3b1c07c794f0eb29e75470dd8c
SHA1 95b5919e9c076ac0df2bf69edc7c054fa106cbbc
SHA256 3e191f28fb9eb8dda3d886e047a8caf9ff7acb0deb2cf148dff9109cc8f7c4e7
SHA512 19ec4bd3287ed0a93f372da4c0690085fc6c3210f6e4943fbb684f6257e17b92e5998d9688dd1f3ba084f1ffc394f040f7053e15ee1fa9383ed387f15a3e8a73

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 7129a8f76d22f505cd5c9e18ea12cb0d
SHA1 d7185aa91c5667c1e517aba7a4fa2e7b6f856d63
SHA256 81f7498ebd470a6cb7a4333b9c44a224f66cac185d6eeab4c62a0639b6b1909b
SHA512 17895b5b5035ad4a58e302bf3564079f33d59100c1d22bb2411da05c13b98563f7524a8590a11b1ad35f9c0620b85aedeeacc796927a8a6069692b5c99ccc51e

C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

MD5 3b077c160f7ab1c388455ecc6d3b49c1
SHA1 e2bdc5b8f6c075f65ed70482e04800cd1357f965
SHA256 3018e4daeeaf8e6720b68986ad8d6037d5c807699f0f5393cc863dbeebf859ef
SHA512 2c29894e51b9c3f27a4df41e5a9cdb2b4e6dfa73026010d2a68ebba73def2a930301882446c08807ad51445ee7f8fa105aca8978c523a56cdb08a24165f64d9a

C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe

MD5 d09198d4a0b2ebc3bea8224888e804a9
SHA1 48c9cbf0145a82cba5c4f8fcfb0b3a257a2d4117
SHA256 710734be45ea27c8fbab06296f669258ce07eb475201ae9beb74716bcc0c91ef
SHA512 70ab9481676f3437eec422d6bd14f88488119445b78dd28ea23e65cae1a34c4cdfb74e1355a0599d1634e7ad0cbac034595a10b95df8c5246a07c87dbed720be

C:\Users\Admin\AppData\Local\Temp\main\extracted\nmYIeCI7gcMH.exe

MD5 b98c04107c877870d49918d37fe88243
SHA1 022456cb93ab56c162c815eb6bb0efc5f8736a0e
SHA256 76d88796bccf1ca6d641057af17e4259f4209f9f2a138430ca5677e245f9b24f
SHA512 db51635ab14c8ea93b1a20c9c909fe42ce2fcec48ba993cde3b40c9f6b32a2cc786d2ef9682770d057d0f7f24b60f4835d513ff8f9537e64c4c1029d02386bea

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 acd37691a022a776c84dd3cea9375d82
SHA1 7bbf230544f44890bc87fc7beb1034526ea30bf0
SHA256 9649b6641b422f37749668dd88f6bfc48f92cc0010a7d2a506eb1c4702022c3c
SHA512 6961e89993149075a4782eaa9bff8b37a37733357f24345a424963458bf4da4eeafccd951f60acd88353957d3775d2419b9687126070228a8c05fd4cc6fa0fea

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 46fdefd56b8dd6b7d89e9d3fd520a2b4
SHA1 51093effbdcb84c1ebdccc1243b55c102dfc68e1
SHA256 e5d6437897aecc785819e8d71cec53eaa242850a7a64cea8aa0d8b0c36a09e8e
SHA512 140f274929591fa628077729db6f266fd55467fa25c5e0b5a006318356db2cb5072577d476577816b86d9293a4cb66e6dd585b57db8a75ec2e91945b2db1375d

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

MD5 faba57eada0da2543973c7855e0771d6
SHA1 5bbcd5c032cf33881ace9bbe7ee9cd9c262cf56f
SHA256 c77d34a65ae3dd723fb38b220d8720ee12660750569251b27a515895711f325c
SHA512 eb3f8fa244dc6577424c51eec10ddf3033b0d3ad0fc9f7ab8d18a3af2abceb9ed7240eb2c7229c08cfd804e9f6fd89bbae8624d001628afea7f994a88b820f9f

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 994cd31649c66548431009cc2ce2c342
SHA1 2e3261722ca820877e2d28103254472589f7b567
SHA256 de9fa9d76222ab4e57ef00f33fbf4b960f792f4cf1cc1bb84b9a9e3ebef1024d
SHA512 02e98b9d09faaa05484b765dfa93141eff26976f42ed4304c2e5f65e6de547d8e0aa1a6eff24fdfd1421e0a7dbfc3c5948d905337694979f788229fba95176ed

memory/3364-63-0x0000000000E00000-0x0000000000F00000-memory.dmp

memory/3048-64-0x0000000000790000-0x000000000079A000-memory.dmp

memory/3048-70-0x0000000000790000-0x000000000079A000-memory.dmp

memory/3048-71-0x0000000000790000-0x000000000079A000-memory.dmp

memory/3048-72-0x0000000000790000-0x000000000079A000-memory.dmp

memory/3048-73-0x0000000000790000-0x000000000079A000-memory.dmp

memory/3048-74-0x0000000002520000-0x0000000002521000-memory.dmp

memory/3048-75-0x0000000000790000-0x000000000079A000-memory.dmp