68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe
Size

488KB
MD5

6ff047f1181667ebef43b9fe8805f56a
SHA1

bfccf361769e5d0eae62c6b70d289692c0b849e7
SHA256

68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320
SHA512

a3e4861ef73655de7aba96101db5ca77ca355977d2b7d519afeb9f33ee6b554e466fbe4db970286ad6d8c3c395684ab8d4c67b6fb5013885a8ceb8d4dd4aea05
SSDEEP

12288:QM2yDfjsHiLaLyV+QzOIiQkkWpHadpdohI:rDYHOlOIiQnWp6dpy

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2584 powershell.exe
Loads dropped DLL 1 IoCs

Processes:

68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe

pid process

2872 68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2584 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2584 powershell.exe

pid	process
2584	powershell.exe

pid	process
2872	68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe

pid	process
2584	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2584	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe

description	pid	process	target process
PID 2872 wrote to memory of 2584	2872	68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe	powershell.exe
PID 2872 wrote to memory of 2584	2872	68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe	powershell.exe
PID 2872 wrote to memory of 2584	2872	68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe	powershell.exe
PID 2872 wrote to memory of 2584	2872	68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe
"C:\Users\Admin\AppData\Local\Temp\68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Jasigers=Get-Content 'C:\Users\Admin\AppData\Roaming\Grydeskeen146\sdfdsf\Huaca.dew';$Realismen=$Jasigers.SubString(54269,3);.$Realismen($Jasigers)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst1CA6.tmp\nsExec.dll

Filesize
6KB

MD5
ac0f93b2dec82e9579bff14c8572a6c8

SHA1
6460244317cbb77e342adb3561ec3acb496c84d5

SHA256
3aa8e0abadefea2de58281198acfe48713a1d5b43aea5619f563cea098e9fd34

SHA512
8055a6af150c45547927499f9cbf645d7f39c8e4f9caff4726fd711d2401abca01a79837095e5752b9f57b06446973ea6506796f2223bdb0179243d6e0575bd2

Download Submit
memory/2584-23-0x0000000073C31000-0x0000000073C32000-memory.dmp

Filesize
4KB

Download
memory/2584-24-0x0000000073C30000-0x00000000741DB000-memory.dmp

Filesize
5.7MB

Download
memory/2584-25-0x0000000073C30000-0x00000000741DB000-memory.dmp

Filesize
5.7MB

Download
memory/2584-26-0x0000000073C30000-0x00000000741DB000-memory.dmp

Filesize
5.7MB

Download
memory/2584-27-0x0000000073C30000-0x00000000741DB000-memory.dmp

Filesize
5.7MB

Download
memory/2584-28-0x0000000073C30000-0x00000000741DB000-memory.dmp

Filesize
5.7MB

Download