25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe
Size 758KB
Sample240607-brscvsfb4y
SHA256 25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f
MD5 fc40ced35443bb1e6e7c04f982707aec
SHA1 5e11965ac4942e69ef646014056f2a7bf42d608a
SHA512 21f16b8761ecb0707c6aa5609ba19741ecb4972783786d7a9a09c05b0b629031ac1156a66aca8c44db91b00cf7ea1061a170670acac356908951da24806ced02
SSDEEP 12288:5qwKVI2AFDaJkVTJheA402+491tY/grOpzVbyNdVIHQrAr6ANHCzLDbDW7aEsy:V81AtrBv402rm/Xp5bgHSQrAWANizjqN
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2196	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Presglas.ini	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2196	powershell.exe
2068	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 2068	2196	powershell.exe	33

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Topmder90\subprojects.ini	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe
File opened for modification	C:\Windows\Fonts\Buchwald.rat	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe
File opened for modification	C:\Windows\Fonts\Unreadiness83\unacting.ini	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe
File opened for modification	C:\Windows\Fonts\Henrikes82.ini	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe
File opened for modification	C:\Windows\resources\Indleveringers209.jog	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2196	2056	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe	28
PID 2056 wrote to memory of 2196	2056	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe	28
PID 2056 wrote to memory of 2196	2056	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe	28
PID 2056 wrote to memory of 2196	2056	25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe	28
PID 2196 wrote to memory of 268	2196	powershell.exe	31
PID 2196 wrote to memory of 268	2196	powershell.exe	31
PID 2196 wrote to memory of 268	2196	powershell.exe	31
PID 2196 wrote to memory of 268	2196	powershell.exe	31
PID 2196 wrote to memory of 2068	2196	powershell.exe	33
PID 2196 wrote to memory of 2068	2196	powershell.exe	33
PID 2196 wrote to memory of 2068	2196	powershell.exe	33
PID 2196 wrote to memory of 2068	2196	powershell.exe	33
PID 2196 wrote to memory of 2068	2196	powershell.exe	33
PID 2196 wrote to memory of 2068	2196	powershell.exe	33

C:\Users\Admin\AppData\Local\Temp\25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe
"C:\Users\Admin\AppData\Local\Temp\25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Eudaemonia=Get-Content 'C:\Users\Admin\AppData\Local\Temp\auf\utryktes.Sub';$Emballage=$Eudaemonia.SubString(44370,3);.$Emballage($Eudaemonia)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    3⤵
    PID:268
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Anomalien.Frf

Path C:\Users\Admin\AppData\Local\Temp\auf\Anomalien.Frf
Size 333KB
SHA256 71b458b9f6014426c16fdd936a4d56aeabd11c4dd5da58c0efe5597f2d36a89a
MD5 f74448ae1c383a0e08e0a9b8ca258f62
SHA1 ecbbd77bddcae4394fee760270fdbd47a04dd070
SHA512 b9b186b48eca7ebc60a6d0b1c40422bf83db1045902f9be63550f89d108b04f8768c24fb4dc02cfd4de0795c1ca1d7c67eb32b8cdb06c0f3bbdef8deab7d8fe8
SSDEEP 6144:/zNrKo5a1m/Y1aqNF8/fDfyzDtqsqylyc6UVeZyBw1UUxdpub0pV8:5Zo1QY1RF8/fD6zDwEMc6pMBw1Ukub0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

utryktes.Sub

Path C:\Users\Admin\AppData\Local\Temp\auf\utryktes.Sub
Size 50KB
SHA256 97d4fd25414969f5ba5998184d00bbb436c42938b3c12ef13de9e788702a9d9d
MD5 7f0a320e8b3492f80b15e5588601b621
SHA1 55dfa720d345c551895c1652c20f6704a50ebcc9
SHA512 4847b8edf11ae3878694f385f71a5c939f5f6ee6f48ee7e6a1f8de02a23be2a631aecc111cdd04ae6140866d9d111fcda4adc0b7dc3f126cc406a5f51ed46271
SSDEEP 1536:6jf37yQon40893HS0OuZSEDKgvkKt5uspB/x6Oz/G:6jTyzpMOTBITt/xnz+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2068-165-0x0000000000250000-0x00000000012B2000-memory.dmp

Download

memory/2196-155-0x0000000073D01000-0x0000000073D02000-memory.dmp

Download

memory/2196-156-0x0000000073D00000-0x00000000742AB000-memory.dmp

Download

memory/2196-159-0x0000000073D00000-0x00000000742AB000-memory.dmp

Download

memory/2196-158-0x0000000073D00000-0x00000000742AB000-memory.dmp

Download

memory/2196-157-0x0000000073D00000-0x00000000742AB000-memory.dmp

Download

memory/2196-163-0x0000000006670000-0x000000000A86E000-memory.dmp

Download

memory/2196-164-0x0000000073D00000-0x00000000742AB000-memory.dmp

Download