Analysis
- max time kernel
140s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
16/03/2024, 10:50
General
- Target cdddc45c50ac19399737b6d348d4f1b8.exe
- Size 417KB
- Sample240316-mxcp5she5v
- SHA256 16a10b64d53d0339f7deb970f1be9250765f328dc0793715bb9ac6d7e6ffc1e0
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Checks for any installed AV software in registry 1 TTPs 2 IoCs
- Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdddc45c50ac19399737b6d348d4f1b8.exe"C:\Users\Admin\AppData\Local\Temp\cdddc45c50ac19399737b6d348d4f1b8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JS4B7.tmp\cdddc45c50ac19399737b6d348d4f1b8.tmp"C:\Users\Admin\AppData\Local\Temp\is-JS4B7.tmp\cdddc45c50ac19399737b6d348d4f1b8.tmp" /SL5="$40218,139007,56832,C:\Users\Admin\AppData\Local\Temp\cdddc45c50ac19399737b6d348d4f1b8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-GL4QE.tmp\ex.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_020ejvbj.f2b.ps1
av.txt
ex.bat
itdownload.dll
cdddc45c50ac19399737b6d348d4f1b8.tmp
memory/2444-51-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2444-2-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2444-0-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2936-7-0x0000000000690000-0x0000000000691000-memory.dmp
memory/2936-53-0x0000000003AA0000-0x0000000003ADC000-memory.dmp
memory/2936-52-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/2936-54-0x0000000000690000-0x0000000000691000-memory.dmp
memory/2936-16-0x0000000003AA0000-0x0000000003ADC000-memory.dmp
memory/4788-21-0x00000000046F0000-0x0000000004726000-memory.dmp
memory/4788-44-0x0000000007320000-0x00000000078C4000-memory.dmp
memory/4788-28-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/4788-38-0x0000000005710000-0x0000000005A64000-memory.dmp
memory/4788-39-0x0000000005CB0000-0x0000000005CCE000-memory.dmp
memory/4788-40-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
memory/4788-41-0x0000000006C60000-0x0000000006CF6000-memory.dmp
memory/4788-42-0x00000000061E0000-0x00000000061FA000-memory.dmp
memory/4788-43-0x0000000006200000-0x0000000006222000-memory.dmp
memory/4788-27-0x00000000055C0000-0x0000000005626000-memory.dmp
memory/4788-45-0x0000000007F50000-0x00000000085CA000-memory.dmp
memory/4788-48-0x0000000073000000-0x00000000737B0000-memory.dmp
memory/4788-26-0x0000000004CF0000-0x0000000004D12000-memory.dmp
memory/4788-25-0x0000000004D60000-0x0000000005388000-memory.dmp
memory/4788-24-0x0000000002600000-0x0000000002610000-memory.dmp
memory/4788-22-0x0000000073000000-0x00000000737B0000-memory.dmp
memory/4788-23-0x0000000002600000-0x0000000002610000-memory.dmp