Overview
overview
10Static
static
1google/INV...BA.url
windows7-x64
1google/INV...BA.url
windows10-2004-x64
1google/INV...AA.url
windows7-x64
1google/INV...AA.url
windows10-2004-x64
1google/dial.lnk
windows7-x64
3google/dial.lnk
windows10-2004-x64
7google/file.bat
windows7-x64
8google/file.bat
windows10-2004-x64
8google/file.ps1
windows7-x64
1google/file.ps1
windows10-2004-x64
10google/file.vbs
windows7-x64
8google/file.vbs
windows10-2004-x64
10google/iz.ps1
windows7-x64
1google/iz.ps1
windows10-2004-x64
1google/kam.cmd
windows7-x64
1google/kam.cmd
windows10-2004-x64
10google/las.cmd
windows7-x64
1google/las.cmd
windows10-2004-x64
10google/pw.ps1
windows7-x64
1google/pw.ps1
windows10-2004-x64
10google/py.ps1
windows7-x64
1google/py.ps1
windows10-2004-x64
10google/quark.ps1
windows7-x64
1google/quark.ps1
windows10-2004-x64
10google/time.ps1
windows7-x64
1google/time.ps1
windows10-2004-x64
10google/update.vbs
windows7-x64
8google/update.vbs
windows10-2004-x64
10google/upload.vbs
windows7-x64
8google/upload.vbs
windows10-2004-x64
10google/version.bat
windows7-x64
1google/version.bat
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 07:38
Static task
static1
Behavioral task
behavioral1
Sample
google/INVOICE-RVSA03HDSVBA.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
google/INVOICE-RVSA03HDSVBA.url
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
google/INVOICE-RVSA03HDSVBAA.url
Resource
win7-20240319-en
Behavioral task
behavioral4
Sample
google/INVOICE-RVSA03HDSVBAA.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
google/dial.lnk
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
google/dial.lnk
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
google/file.bat
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
google/file.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
google/file.ps1
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
google/file.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
google/file.vbs
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
google/file.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
google/iz.ps1
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
google/iz.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
google/kam.cmd
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
google/kam.cmd
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
google/las.cmd
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
google/las.cmd
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
google/pw.ps1
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
google/pw.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
google/py.ps1
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
google/py.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
google/quark.ps1
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
google/quark.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
google/time.ps1
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
google/time.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
google/update.vbs
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
google/update.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
google/upload.vbs
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
google/upload.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
google/version.bat
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
google/version.bat
Resource
win10v2004-20240412-en
General
-
Target
google/py.ps1
-
Size
13.0MB
-
MD5
7b39704c31b1737acfe3fd4d5c2b484c
-
SHA1
21afe7606b8b55b6f99e7bfb798a1f82a1c1c96a
-
SHA256
d8fb42967c3a5ad703a9bfa2ed0a5e037646e9f04e55009220b94a8a8326b564
-
SHA512
e47887922094c24e4855c6e3a5d124de817ced17a87e7e7cdd8129e851cc3054e27c958c0c784167b743669dfa2786abd3f8e1524b2c4c2bcb7acde54b1a4357
-
SSDEEP
24576:rpyaxmgWghevRgMNxAuL9jZXOPFIsKgSo2cMkTCJeyS/eM8dCXqNb9m6Kx/pOgWW:6mVhTP3+SVb02XpOoxz3pM1xqZzSXX
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2924 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2924 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2924-4-0x000000001B2E0000-0x000000001B5C2000-memory.dmpFilesize
2.9MB
-
memory/2924-6-0x000007FEF58C0000-0x000007FEF625D000-memory.dmpFilesize
9.6MB
-
memory/2924-5-0x00000000022E0000-0x00000000022E8000-memory.dmpFilesize
32KB
-
memory/2924-7-0x00000000028E0000-0x0000000002960000-memory.dmpFilesize
512KB
-
memory/2924-8-0x000007FEF58C0000-0x000007FEF625D000-memory.dmpFilesize
9.6MB
-
memory/2924-9-0x00000000028E0000-0x0000000002960000-memory.dmpFilesize
512KB
-
memory/2924-10-0x00000000028E0000-0x0000000002960000-memory.dmpFilesize
512KB
-
memory/2924-11-0x00000000028E0000-0x0000000002960000-memory.dmpFilesize
512KB
-
memory/2924-12-0x000007FEF58C0000-0x000007FEF625D000-memory.dmpFilesize
9.6MB
-
memory/2924-13-0x00000000028E0000-0x0000000002960000-memory.dmpFilesize
512KB
-
memory/2924-14-0x000007FEF58C0000-0x000007FEF625D000-memory.dmpFilesize
9.6MB
-
memory/2924-15-0x00000000028E0000-0x0000000002960000-memory.dmpFilesize
512KB
-
memory/2924-16-0x00000000028E0000-0x0000000002960000-memory.dmpFilesize
512KB
-
memory/2924-17-0x00000000028E0000-0x0000000002960000-memory.dmpFilesize
512KB