Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 01:05

General

  • Target

    1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe

  • Size

    627KB

  • MD5

    f64ac2d52a86b86f08b6c4bdc2d443e8

  • SHA1

    9268869f34ee1669642d8772273852789ec8fec9

  • SHA256

    1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3

  • SHA512

    b0ae630ff80b5277408c18a2d6bbd0c405ab370d0549607e3f3093feb1a1f9807fe4b6433d8b9fd5a4c6f105e7583c602594d356df7b5a6a15bc127fc20c7b9b

  • SSDEEP

    12288:wSO9Dx9JGtrjUCb5O3GwrJdovetVZK/WNIc9MSuklCpNkkblz1JEV2PjC/64owCY:NOdJGhjXs3GwrYv9/WNjySudblrs2Pj8

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe
    "C:\Users\Admin\AppData\Local\Temp\1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5108
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBuAGQAZQB4AFwAUABhAHIAYQBtAGUAdABlAHIAcwAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBuAGQAZQB4AFwAUABhAHIAYQBtAGUAdABlAHIAcwAuAGUAeABlAA==
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:816
  • C:\Users\Admin\AppData\Roaming\Index\Parameters.exe
    C:\Users\Admin\AppData\Roaming\Index\Parameters.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3032

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k1rxd5yb.gru.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Roaming\Index\Parameters.exe

          Filesize

          627KB

          MD5

          f64ac2d52a86b86f08b6c4bdc2d443e8

          SHA1

          9268869f34ee1669642d8772273852789ec8fec9

          SHA256

          1de70ae6a465a3132c37a907f37be0410e6febd57eb5a02b26711ddab94a85c3

          SHA512

          b0ae630ff80b5277408c18a2d6bbd0c405ab370d0549607e3f3093feb1a1f9807fe4b6433d8b9fd5a4c6f105e7583c602594d356df7b5a6a15bc127fc20c7b9b

        • memory/816-8-0x00007FFDE63E0000-0x00007FFDE6EA1000-memory.dmp

          Filesize

          10.8MB

        • memory/816-21-0x00007FFDE63E0000-0x00007FFDE6EA1000-memory.dmp

          Filesize

          10.8MB

        • memory/816-18-0x0000020729250000-0x0000020729272000-memory.dmp

          Filesize

          136KB

        • memory/816-7-0x00007FFDE63E0000-0x00007FFDE6EA1000-memory.dmp

          Filesize

          10.8MB

        • memory/4464-31-0x00007FFDE5BF0000-0x00007FFDE66B1000-memory.dmp

          Filesize

          10.8MB

        • memory/4464-28-0x00007FFDE5BF0000-0x00007FFDE66B1000-memory.dmp

          Filesize

          10.8MB

        • memory/5108-4-0x0000026B7A6B0000-0x0000026B7A706000-memory.dmp

          Filesize

          344KB

        • memory/5108-6-0x0000026B7C080000-0x0000026B7C0D4000-memory.dmp

          Filesize

          336KB

        • memory/5108-5-0x0000026B7A710000-0x0000026B7A75C000-memory.dmp

          Filesize

          304KB

        • memory/5108-0-0x0000026B7A1F0000-0x0000026B7A292000-memory.dmp

          Filesize

          648KB

        • memory/5108-25-0x00007FFDE63E0000-0x00007FFDE6EA1000-memory.dmp

          Filesize

          10.8MB

        • memory/5108-3-0x00007FFDE63E0000-0x00007FFDE6EA1000-memory.dmp

          Filesize

          10.8MB

        • memory/5108-2-0x0000026B7C170000-0x0000026B7C270000-memory.dmp

          Filesize

          1024KB

        • memory/5108-1-0x00007FFDE63E3000-0x00007FFDE63E5000-memory.dmp

          Filesize

          8KB