Overview
overview
7Static
static
3WindowsPow...er.ps1
windows7-x64
1WindowsPow...er.ps1
windows10-2004-x64
1WindowsPow...ls.ps1
windows7-x64
1WindowsPow...ls.ps1
windows10-2004-x64
1WindowsPow...er.ps1
windows7-x64
1WindowsPow...er.ps1
windows10-2004-x64
1WindowsPow...er.ps1
windows7-x64
1WindowsPow...er.ps1
windows10-2004-x64
1WindowsPow...cd.dll
windows7-x64
1WindowsPow...cd.dll
windows10-2004-x64
1WindowsPow...es.dll
windows7-x64
1WindowsPow...es.dll
windows10-2004-x64
1WindowsPow...es.dll
windows7-x64
1WindowsPow...es.dll
windows10-2004-x64
1WindowsPow...tc.ps1
windows7-x64
1WindowsPow...tc.ps1
windows10-2004-x64
1WindowsPow...es.dll
windows7-x64
1WindowsPow...es.dll
windows10-2004-x64
1WindowsPow...le.ps1
windows7-x64
1WindowsPow...le.ps1
windows10-2004-x64
1WindowsPow...s.psd1
windows7-x64
1WindowsPow...s.psd1
windows10-2004-x64
1WindowsPow...V.psd1
windows7-x64
1WindowsPow...V.psd1
windows10-2004-x64
1WindowsPow...at.xml
windows7-x64
1WindowsPow...at.xml
windows10-2004-x64
1WindowsPow....cdxml
windows7-x64
3WindowsPow....cdxml
windows10-2004-x64
7WindowsPow....cdxml
windows7-x64
3WindowsPow....cdxml
windows10-2004-x64
7WindowsPow...t.psd1
windows7-x64
1WindowsPow...t.psd1
windows10-2004-x64
1Resubmissions
15/04/2024, 17:37
240415-v66nksed8w 715/04/2024, 17:34
240415-v5ll1sed3z 715/04/2024, 17:30
240415-v3fmzsca66 315/04/2024, 17:27
240415-v1vdcseb8w 7Analysis
-
max time kernel
27s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 17:37
Static task
static1
Behavioral task
behavioral1
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataAdapter.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataAdapter.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtils.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtils.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtilsHelper.ps1
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtilsHelper.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataV4Adapter.ps1
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataV4Adapter.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/en/Microsoft.Windows.Bcd.Cmdlets.Resources.dll
Resource
win7-20240319-en
Behavioral task
behavioral12
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/en/Microsoft.Windows.Bcd.Cmdlets.Resources.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/en/Microsoft.Windows.Bcd.Resources.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/en/Microsoft.Windows.Bcd.Resources.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
WindowsPowerShell/v1.0/Modules/MsDtc/TestDtc.ps1
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
WindowsPowerShell/v1.0/Modules/MsDtc/TestDtc.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
WindowsPowerShell/v1.0/Modules/MsDtc/en/Microsoft.Dtc.PowerShell.Resources.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
WindowsPowerShell/v1.0/Modules/MsDtc/en/Microsoft.Dtc.PowerShell.Resources.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
WindowsPowerShell/v1.0/Modules/SmbShare/SmbScriptModule.ps1
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
WindowsPowerShell/v1.0/Modules/SmbShare/SmbScriptModule.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
WindowsPowerShell/v1.0/Modules/TLS/tls.psd1
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
WindowsPowerShell/v1.0/Modules/TLS/tls.psd1
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
WindowsPowerShell/v1.0/Modules/UEV/UEV.psd1
Resource
win7-20240319-en
Behavioral task
behavioral24
Sample
WindowsPowerShell/v1.0/Modules/UEV/UEV.psd1
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
WindowsPowerShell/v1.0/Modules/VMDirectStorage/VMDirectStorage.format.xml
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
WindowsPowerShell/v1.0/Modules/VMDirectStorage/VMDirectStorage.format.xml
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnection_v1.0.0.cdxml
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnection_v1.0.0.cdxml
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnServerAddress_v1.0.cdxml
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnServerAddress_v1.0.cdxml
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
WindowsPowerShell/v1.0/Modules/VpnClient/VpnClient.psd1
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
WindowsPowerShell/v1.0/Modules/VpnClient/VpnClient.psd1
Resource
win10v2004-20240412-en
General
-
Target
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnServerAddress_v1.0.cdxml
-
Size
1KB
-
MD5
f45547e60663d7b4bc02a4182fda841d
-
SHA1
a0a2bbdcd7f33e988115c588bd77fa80c3de7456
-
SHA256
71813b448a93a70d846dee293ebee26d0f3d75d2601c96e8a25a954857045622
-
SHA512
c78478485365d87e89f523615fbcbdcb3882e1795ad07cdbaa4e6730c3f0f02201bbe956e4686d060922bfea7793fa1599963ab447a329ca17dc4a8062610a69
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cdxml_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cdxml_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cdxml_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cdxml_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cdxml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.cdxml rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.cdxml\ = "cdxml_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cdxml_auto_file\shell\Read rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2620 AcroRd32.exe 2620 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2552 3000 cmd.exe 29 PID 3000 wrote to memory of 2552 3000 cmd.exe 29 PID 3000 wrote to memory of 2552 3000 cmd.exe 29 PID 2552 wrote to memory of 2620 2552 rundll32.exe 30 PID 2552 wrote to memory of 2620 2552 rundll32.exe 30 PID 2552 wrote to memory of 2620 2552 rundll32.exe 30 PID 2552 wrote to memory of 2620 2552 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\v1.0\Modules\VpnClient\PS_VpnServerAddress_v1.0.cdxml1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\v1.0\Modules\VpnClient\PS_VpnServerAddress_v1.0.cdxml2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\v1.0\Modules\VpnClient\PS_VpnServerAddress_v1.0.cdxml"3⤵
- Suspicious use of SetWindowsHookEx
PID:2620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f1e0b20930d626b55d95bccb4d31e5a0
SHA15886ba20bb745781816f4563f547643245dfe531
SHA2561f615dc33d7076325372adac48b9d18ea0bafbc34385b35d854a2a47497f46c3
SHA512e4c50d1d101411dc458ce2a3032ad72a6fe8f16ccb2b83942a6f815d9fc8ef2e57e93e5bf20bca54ac10f6d676247b18277f558a7a1da93d667b539df4caa975