Analysis
-
max time kernel
142s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 07:12
Static task
static1
Behavioral task
behavioral1
Sample
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe
Resource
win10v2004-20240508-en
General
-
Target
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe
-
Size
26KB
-
MD5
1f90151f3470f316a645a6617534a0be
-
SHA1
80dd3641418ff22c353b2d1f0f4c86990cfdaee1
-
SHA256
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c
-
SHA512
5609219d6a7ece553032589d9765e7fcf394253fa4df5d64539e231a4350bf9c8b3bfd2ec5ca1904a6584b793f3a174353261e23983f7ac428b7957379eccbcf
-
SSDEEP
384:YJwutFK4KLt/WFg46SL4E3y3jBPc3jrUGjC/8wLSV6f3pRLXjjF:kFK4ueF/xAWj4YCEUSK9jjF
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/4200-7-0x00000000068C0000-0x0000000006994000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exedescription pid process target process PID 4200 set thread context of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exepid process 3148 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exePowershell.exepid process 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 1232 Powershell.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 1232 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exePowershell.exeaae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exedescription pid process Token: SeDebugPrivilege 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Token: SeDebugPrivilege 1232 Powershell.exe Token: SeDebugPrivilege 3148 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exedescription pid process target process PID 4200 wrote to memory of 1232 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe PID 4200 wrote to memory of 1232 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe PID 4200 wrote to memory of 1232 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe PID 4200 wrote to memory of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4200 wrote to memory of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4200 wrote to memory of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4200 wrote to memory of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4200 wrote to memory of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4200 wrote to memory of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4200 wrote to memory of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4200 wrote to memory of 3148 4200 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe"C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe' -Force2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe"C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yigba3vt.lqf.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1232-130-0x0000000006130000-0x000000000614E000-memory.dmpFilesize
120KB
-
memory/1232-133-0x0000000006620000-0x000000000663A000-memory.dmpFilesize
104KB
-
memory/1232-138-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/1232-134-0x0000000006670000-0x0000000006692000-memory.dmpFilesize
136KB
-
memory/1232-131-0x00000000061B0000-0x00000000061FC000-memory.dmpFilesize
304KB
-
memory/1232-14-0x0000000005170000-0x0000000005192000-memory.dmpFilesize
136KB
-
memory/1232-17-0x0000000005B30000-0x0000000005E84000-memory.dmpFilesize
3.3MB
-
memory/1232-132-0x0000000007100000-0x0000000007196000-memory.dmpFilesize
600KB
-
memory/1232-16-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/1232-15-0x0000000005970000-0x00000000059D6000-memory.dmpFilesize
408KB
-
memory/1232-11-0x0000000002850000-0x0000000002886000-memory.dmpFilesize
216KB
-
memory/1232-12-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/1232-13-0x0000000005240000-0x0000000005868000-memory.dmpFilesize
6.2MB
-
memory/3148-88-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-78-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-897-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3148-895-0x0000000005360000-0x00000000053B6000-memory.dmpFilesize
344KB
-
memory/3148-896-0x00000000053C0000-0x000000000540C000-memory.dmpFilesize
304KB
-
memory/3148-27-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3148-29-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3148-30-0x0000000002C10000-0x0000000002CD6000-memory.dmpFilesize
792KB
-
memory/3148-32-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3148-894-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3148-36-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-74-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-86-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-94-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-92-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-33-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-34-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-90-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-38-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-84-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-82-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-40-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-42-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-44-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-46-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-80-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-48-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-76-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-72-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-70-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-68-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-66-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-64-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-62-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-60-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-58-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-56-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-54-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-52-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/3148-50-0x0000000002C10000-0x0000000002CD0000-memory.dmpFilesize
768KB
-
memory/4200-10-0x0000000006CB0000-0x0000000006D16000-memory.dmpFilesize
408KB
-
memory/4200-1-0x0000000000B40000-0x0000000000B4C000-memory.dmpFilesize
48KB
-
memory/4200-2-0x0000000005A10000-0x0000000005FB4000-memory.dmpFilesize
5.6MB
-
memory/4200-3-0x0000000005540000-0x00000000055D2000-memory.dmpFilesize
584KB
-
memory/4200-4-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/4200-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmpFilesize
4KB
-
memory/4200-5-0x00000000055F0000-0x00000000055FA000-memory.dmpFilesize
40KB
-
memory/4200-6-0x00000000057E0000-0x0000000005856000-memory.dmpFilesize
472KB
-
memory/4200-31-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/4200-7-0x00000000068C0000-0x0000000006994000-memory.dmpFilesize
848KB
-
memory/4200-8-0x0000000006990000-0x00000000069AE000-memory.dmpFilesize
120KB
-
memory/4200-9-0x0000000006C10000-0x0000000006CAC000-memory.dmpFilesize
624KB