Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-05-2024 07:12
Static task
static1
Behavioral task
behavioral1
Sample
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe
Resource
win10v2004-20240508-en
General
-
Target
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe
-
Size
26KB
-
MD5
1f90151f3470f316a645a6617534a0be
-
SHA1
80dd3641418ff22c353b2d1f0f4c86990cfdaee1
-
SHA256
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c
-
SHA512
5609219d6a7ece553032589d9765e7fcf394253fa4df5d64539e231a4350bf9c8b3bfd2ec5ca1904a6584b793f3a174353261e23983f7ac428b7957379eccbcf
-
SSDEEP
384:YJwutFK4KLt/WFg46SL4E3y3jBPc3jrUGjC/8wLSV6f3pRLXjjF:kFK4ueF/xAWj4YCEUSK9jjF
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4972-7-0x0000000006C10000-0x0000000006CE4000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exedescription pid process target process PID 4972 set thread context of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exepid process 2360 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exePowershell.exepid process 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 3936 Powershell.exe 3936 Powershell.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exePowershell.exeaae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exedescription pid process Token: SeDebugPrivilege 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Token: SeDebugPrivilege 3936 Powershell.exe Token: SeDebugPrivilege 2360 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exedescription pid process target process PID 4972 wrote to memory of 3936 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe PID 4972 wrote to memory of 3936 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe PID 4972 wrote to memory of 3936 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe Powershell.exe PID 4972 wrote to memory of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4972 wrote to memory of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4972 wrote to memory of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4972 wrote to memory of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4972 wrote to memory of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4972 wrote to memory of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4972 wrote to memory of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe PID 4972 wrote to memory of 2360 4972 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe"C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe' -Force2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe"C:\Users\Admin\AppData\Local\Temp\aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iecowqjz.bgg.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2360-58-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-54-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-897-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/2360-33-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-31-0x0000000005170000-0x0000000005236000-memory.dmpFilesize
792KB
-
memory/2360-32-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-35-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-37-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-39-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-62-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-76-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-83-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-42-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-78-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-44-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-46-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-48-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-50-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-52-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-74-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-56-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-30-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2360-84-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-88-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-96-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-196-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/2360-60-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-94-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-92-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-90-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-64-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-80-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-66-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-68-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-86-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-891-0x00000000053A0000-0x00000000053EC000-memory.dmpFilesize
304KB
-
memory/2360-70-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-887-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/2360-72-0x0000000005170000-0x0000000005230000-memory.dmpFilesize
768KB
-
memory/2360-888-0x0000000005340000-0x0000000005396000-memory.dmpFilesize
344KB
-
memory/3936-26-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/3936-896-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/3936-890-0x0000000006610000-0x000000000662A000-memory.dmpFilesize
104KB
-
memory/3936-14-0x0000000005150000-0x0000000005172000-memory.dmpFilesize
136KB
-
memory/3936-889-0x00000000070D0000-0x0000000007166000-memory.dmpFilesize
600KB
-
memory/3936-892-0x0000000006660000-0x0000000006682000-memory.dmpFilesize
136KB
-
memory/3936-11-0x0000000004C60000-0x0000000004C96000-memory.dmpFilesize
216KB
-
memory/3936-15-0x00000000051F0000-0x0000000005256000-memory.dmpFilesize
408KB
-
memory/3936-28-0x0000000006120000-0x000000000616C000-memory.dmpFilesize
304KB
-
memory/3936-27-0x0000000006100000-0x000000000611E000-memory.dmpFilesize
120KB
-
memory/3936-12-0x0000000005310000-0x000000000593A000-memory.dmpFilesize
6.2MB
-
memory/3936-13-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/3936-16-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/3936-17-0x0000000005BC0000-0x0000000005F17000-memory.dmpFilesize
3.3MB
-
memory/4972-0-0x000000007446E000-0x000000007446F000-memory.dmpFilesize
4KB
-
memory/4972-1-0x0000000000DD0000-0x0000000000DDC000-memory.dmpFilesize
48KB
-
memory/4972-2-0x0000000005F20000-0x00000000064C6000-memory.dmpFilesize
5.6MB
-
memory/4972-311-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/4972-10-0x0000000007010000-0x0000000007076000-memory.dmpFilesize
408KB
-
memory/4972-9-0x0000000006F70000-0x000000000700C000-memory.dmpFilesize
624KB
-
memory/4972-8-0x0000000006CE0000-0x0000000006CFE000-memory.dmpFilesize
120KB
-
memory/4972-7-0x0000000006C10000-0x0000000006CE4000-memory.dmpFilesize
848KB
-
memory/4972-6-0x0000000005B20000-0x0000000005B96000-memory.dmpFilesize
472KB
-
memory/4972-5-0x0000000005930000-0x000000000593A000-memory.dmpFilesize
40KB
-
memory/4972-4-0x0000000074460000-0x0000000074C11000-memory.dmpFilesize
7.7MB
-
memory/4972-3-0x0000000005890000-0x0000000005922000-memory.dmpFilesize
584KB