579b90e2ac3f15921d4a49998dd395645a8d0aab142d4765ca29f84be465840d

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
Size

617KB
MD5

3386773652cab6d42e5eb77f33b414c2
SHA1

46af3a4f285a71a1f27b67e79359d980612226b4
SHA256

6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d
SHA512

cd6f3a152ae82ea19686f83d26eac06e888dfe753bb8fc863570a2a1a6db3b9c5fedf910b71e2d40886c07d650c4b35faf69c1f322560bc67539728b9aceb7c2
SSDEEP

12288:l2iKVaUqdJS4Vo5pLRpHiANQ6elKQI64i55oc:Y+UgSckQ61Qd4iToc

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2504	powershell.exe
2604	powershell.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
2504	powershell.exe
2604	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2504	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	28
PID 1152 wrote to memory of 2504	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	28
PID 1152 wrote to memory of 2504	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	28
PID 1152 wrote to memory of 2504	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	28
PID 1152 wrote to memory of 2604	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	30
PID 1152 wrote to memory of 2604	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	30
PID 1152 wrote to memory of 2604	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	30
PID 1152 wrote to memory of 2604	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	30
PID 1152 wrote to memory of 2648	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	31
PID 1152 wrote to memory of 2648	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	31
PID 1152 wrote to memory of 2648	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	31
PID 1152 wrote to memory of 2648	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	31
PID 1152 wrote to memory of 2448	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	34
PID 1152 wrote to memory of 2448	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	34
PID 1152 wrote to memory of 2448	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	34
PID 1152 wrote to memory of 2448	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	34
PID 1152 wrote to memory of 2508	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	35
PID 1152 wrote to memory of 2508	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	35
PID 1152 wrote to memory of 2508	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	35
PID 1152 wrote to memory of 2508	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	35
PID 1152 wrote to memory of 2396	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	36
PID 1152 wrote to memory of 2396	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	36
PID 1152 wrote to memory of 2396	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	36
PID 1152 wrote to memory of 2396	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	36
PID 1152 wrote to memory of 2404	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	37
PID 1152 wrote to memory of 2404	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	37
PID 1152 wrote to memory of 2404	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	37
PID 1152 wrote to memory of 2404	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	37
PID 1152 wrote to memory of 2456	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	38
PID 1152 wrote to memory of 2456	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	38
PID 1152 wrote to memory of 2456	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	38
PID 1152 wrote to memory of 2456	1152	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	38

C:\Users\Admin\AppData\Local\Temp\6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
"C:\Users\Admin\AppData\Local\Temp\6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZFDfJPJOzHNzUJ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZFDfJPJOzHNzUJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD440.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD440.tmp

Filesize
1KB

MD5
2b00d06d8d7c8d09e361012c1865143d

SHA1
840569968abb37c4e1a67d0e4fa03091231ca827

SHA256
545f86eb62023ded9a7f5600a1256689b2466ed8e84163c1dec2a59821f4297f

SHA512
d0fdadf1742f63aebc9b922246859d13e0749097400ef3f7926a5b8e513f1a371af1855d381db8feb1b6d468430f0c899f6d831249ea7ead81f303f02e0d70f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0CX26I5AG8S3CPAVBTCU.temp

Filesize
7KB

MD5
6c04516f2ddad2988d54e50f63dac804

SHA1
8c6ffe37b92b17c7aab8862082c2383a97553842

SHA256
d6f41552e76d2c159c640b28795658b11e5ef034e0e14604cade9566e002b33a

SHA512
d49f94a65da6c5ebb0d7006a8916f8f942b902f9c60eb23098e96a38ccb577381b993cbc453fcdf3adae95e14b61c4d2a706489e3292300e2c892736cc1bb510

Download Submit
memory/1152-0-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

Filesize
4KB

Download
memory/1152-1-0x0000000001270000-0x0000000001310000-memory.dmp

Filesize
640KB

Download
memory/1152-2-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/1152-3-0x0000000000510000-0x0000000000528000-memory.dmp

Filesize
96KB

Download
memory/1152-4-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/1152-5-0x0000000004BF0000-0x0000000004C52000-memory.dmp

Filesize
392KB

Download
memory/1152-6-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

Filesize
4KB

Download
memory/1152-19-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download