b7c2ddf77ff7bcc93ac0e5df3e6d03ec3c15103feff0f3cd96662342a40f273e

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe
Size 863KB
Sample240417-rbh29aah46
SHA256 3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34
MD5 80d8911cf9f3ccaa526a6afda63a4ae1
SHA1 a434e9f052a8c8b5ca0bca099e49317f15033bb3
SHA512 f2053a6e8dda2eff2b8ddfb1312c150dbe1f66d5a6029abc4284b9d6261817ba165359b83ab5ee99934acc23eb5603987a662aa21d911d9b66a8ad15847958ee
SSDEEP 12288:hIrQbs3XWa23NQHD9Olb6yboUTMJ2qSpGH8VCX5q//X5M/u1Lr:cuQXWj3NQROlOyboUTin8Vw5MqUr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4020	4908	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4908	3976	3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe	87
PID 3976 wrote to memory of 4908	3976	3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe	87
PID 3976 wrote to memory of 4908	3976	3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe	87
PID 4908 wrote to memory of 5028	4908	powershell.exe	92
PID 4908 wrote to memory of 5028	4908	powershell.exe	92
PID 4908 wrote to memory of 5028	4908	powershell.exe	92

C:\Users\Admin\AppData\Local\Temp\3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe
"C:\Users\Admin\AppData\Local\Temp\3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -windowstyle hidden "$Ambulatorisk=Get-Content 'C:\Users\Admin\AppData\Roaming\akroterion\archmugwump\Meanwhiles.Bly';$Rubanke=$Ambulatorisk.SubString(63664,3);.$Rubanke($Ambulatorisk)"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 2696
    3⤵
    - Program crash
    PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4908 -ip 4908
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_5sfypbad.0dl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5sfypbad.0dl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Meanwhiles.Bly

Path C:\Users\Admin\AppData\Roaming\akroterion\archmugwump\Meanwhiles.Bly
Size 62KB
SHA256 f15b38a25f98ff312589b715a871359d8008bba74884f3a0f3ba14dffd269af1
MD5 8ae5a440769b5c5dcd2f0c137fb7e373
SHA1 45991089539f7aead1367746762b05600c28e40b
SHA512 04d53e16021b852fb02c558c4ebea9f0966d94bb4695fea982f66cfc36dcc5a306229c97b78501d336ffc42c4ea72e13571d7754a09b20dfa2cff7cd01bcfa2b
SSDEEP 1536:z2CXD6vF6OlRhR9+8R2cLKuzdLrSRBQHEMoqd:6WaZk8RzThr6+HPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4908-25-0x0000000005DF0000-0x0000000006144000-memory.dmp

Download

memory/4908-26-0x00000000062B0000-0x00000000062CE000-memory.dmp

Download

memory/4908-13-0x0000000005300000-0x0000000005322000-memory.dmp

Download

memory/4908-10-0x0000000073680000-0x0000000073E30000-memory.dmp

Download

memory/4908-14-0x0000000005C10000-0x0000000005C76000-memory.dmp

Download

memory/4908-15-0x0000000005C80000-0x0000000005CE6000-memory.dmp

Download

memory/4908-9-0x0000000002CD0000-0x0000000002D06000-memory.dmp

Download

memory/4908-12-0x0000000005570000-0x0000000005B98000-memory.dmp

Download

memory/4908-27-0x00000000062F0000-0x000000000633C000-memory.dmp

Download

memory/4908-28-0x0000000007480000-0x0000000007516000-memory.dmp

Download

memory/4908-29-0x0000000006800000-0x000000000681A000-memory.dmp

Download

memory/4908-30-0x0000000006820000-0x0000000006842000-memory.dmp

Download

memory/4908-31-0x0000000007AD0000-0x0000000008074000-memory.dmp

Download

memory/4908-11-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/4908-33-0x0000000008700000-0x0000000008D7A000-memory.dmp

Download

memory/4908-35-0x0000000073680000-0x0000000073E30000-memory.dmp

Download