Analysis
- max time kernel
21s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 01:44
General
- Target 6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b.exe
- Size 558KB
- Sample240607-b5sksagf74
- SHA256 6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 4 IoCs
- Detects executables containing common artifacts observed in infostealers 4 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b.exe"C:\Users\Admin\AppData\Local\Temp\6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PolzgTJZg.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PolzgTJZg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA7E8.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b.exe"C:\Users\Admin\AppData\Local\Temp\6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b.exe"C:\Users\Admin\AppData\Local\Temp\6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0onzfgot.fyw.ps1
tmpA7E8.tmp
0f5007522459c86e95ffcc62f32308f1_39fbc0df-d496-4ae0-b1d7-bde60e245d90
0f5007522459c86e95ffcc62f32308f1_39fbc0df-d496-4ae0-b1d7-bde60e245d90
memory/1140-35-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1140-114-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1140-106-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1140-36-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1348-34-0x0000000006150000-0x00000000064A4000-memory.dmp
memory/1348-17-0x00000000058B0000-0x0000000005ED8000-memory.dmp
memory/1348-90-0x0000000074C90000-0x0000000075440000-memory.dmp
memory/1348-15-0x0000000005100000-0x0000000005136000-memory.dmp
memory/1348-83-0x0000000007C20000-0x0000000007C2E000-memory.dmp
memory/1348-18-0x0000000074C90000-0x0000000075440000-memory.dmp
memory/1348-22-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/1348-23-0x0000000074C90000-0x0000000075440000-memory.dmp
memory/1348-51-0x0000000006C80000-0x0000000006CB2000-memory.dmp
memory/1348-52-0x0000000073760000-0x00000000737AC000-memory.dmp
memory/1348-81-0x0000000007C70000-0x0000000007D06000-memory.dmp
memory/1348-75-0x00000000079F0000-0x0000000007A0A000-memory.dmp
memory/1348-49-0x00000000066C0000-0x00000000066DE000-memory.dmp
memory/1348-50-0x0000000006710000-0x000000000675C000-memory.dmp
memory/1348-33-0x0000000074C90000-0x0000000075440000-memory.dmp
memory/1348-77-0x0000000007A60000-0x0000000007A6A000-memory.dmp
memory/1348-73-0x0000000006CC0000-0x0000000006CDE000-memory.dmp
memory/1348-21-0x0000000005730000-0x0000000005796000-memory.dmp
memory/1348-20-0x0000000005610000-0x0000000005632000-memory.dmp
memory/2616-8-0x0000000006990000-0x00000000069A0000-memory.dmp
memory/2616-16-0x0000000074C9E000-0x0000000074C9F000-memory.dmp
memory/2616-1-0x0000000000D30000-0x0000000000DC0000-memory.dmp
memory/2616-2-0x0000000005CC0000-0x0000000006264000-memory.dmp
memory/2616-6-0x0000000008480000-0x0000000008496000-memory.dmp
memory/2616-3-0x00000000057B0000-0x0000000005842000-memory.dmp
memory/2616-4-0x0000000005950000-0x000000000595A000-memory.dmp
memory/2616-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp
memory/2616-9-0x00000000069C0000-0x0000000006A22000-memory.dmp
memory/2616-39-0x0000000074C90000-0x0000000075440000-memory.dmp
memory/2616-5-0x0000000074C90000-0x0000000075440000-memory.dmp
memory/2616-10-0x0000000006C40000-0x0000000006CDC000-memory.dmp
memory/2616-7-0x0000000006980000-0x000000000698E000-memory.dmp
memory/4632-76-0x0000000007CC0000-0x000000000833A000-memory.dmp
memory/4632-86-0x00000000078D0000-0x00000000078D8000-memory.dmp
memory/4632-85-0x00000000078F0000-0x000000000790A000-memory.dmp
memory/4632-84-0x00000000077F0000-0x0000000007804000-memory.dmp
memory/4632-89-0x0000000074C90000-0x0000000075440000-memory.dmp
memory/4632-38-0x0000000074C90000-0x0000000075440000-memory.dmp
memory/4632-82-0x00000000077B0000-0x00000000077C1000-memory.dmp
memory/4632-72-0x0000000006810000-0x000000000682E000-memory.dmp
memory/4632-74-0x00000000072A0000-0x0000000007343000-memory.dmp
memory/4632-53-0x0000000073760000-0x00000000737AC000-memory.dmp