bbe95e9ff2e1cd600ca63527b8b16a146cc1f28c77f415b0d9aa3c9aa972d12c

Resubmissions

10/06/2024, 12:50

240610-p28pgswblf3

10/06/2024, 12:45

240610-pzhehswajc3

10/06/2024, 12:41

240610-pw2nzsvhka3

10/06/2024, 12:34

240610-prx51awbpp3

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup_signed.ps1
Size 48KB
Sample240610-p28pgswblf
SHA256 3ca638018b2b3ca8d3183e3ee4d97d6a6914ce0f1b7046900a4aa1e1f30e0ce8
MD5 3fa0145de8ac0fdd37ff2a87ac822eae
SHA1 78f8e7420f1a6141d540b913bf763f7cd2fc0d99
SHA512 341be7e8266716a387e1aed9d9654f04eac2036301f3596b276d728400558855e5b610f89ebb4321e9a262e88fec2134c448f3bbece35c4eb03b4ac5cd47f408
SSDEEP 768:+CwyApqvg5c7qaw5Z0we5KqTeN3EHwyZqdlNiI68d1sQhDW9Q+Nn8JjxZEJvtrjH:z5KlCpQEKleH7+pg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2164	notepad.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2136	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2872	2136	powershell.exe	31
PID 2136 wrote to memory of 2872	2136	powershell.exe	31
PID 2136 wrote to memory of 2872	2136	powershell.exe	31
PID 2872 wrote to memory of 364	2872	csc.exe	32
PID 2872 wrote to memory of 364	2872	csc.exe	32
PID 2872 wrote to memory of 364	2872	csc.exe	32
PID 2136 wrote to memory of 900	2136	powershell.exe	33
PID 2136 wrote to memory of 900	2136	powershell.exe	33
PID 2136 wrote to memory of 900	2136	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Setup_signed.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-ixsxtmo.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD51B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD51A.tmp"
    3⤵
    PID:364
- C:\Windows\system32\HOSTNAME.EXE
  "C:\Windows\system32\HOSTNAME.EXE"
  2⤵
  PID:900

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:988

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\Setup_signed.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

-ixsxtmo.dll

Path C:\Users\Admin\AppData\Local\Temp\-ixsxtmo.dll
Size 4KB
SHA256 fcd2b862042854b7e68d123cb5132ec07be0c33c17be3dcf113d777700963dd0
MD5 a3565d418ce0d28213c4fc406393b81c
SHA1 d66ef53fe910c8d4b7dc00f9edfdbc7f23e7efbf
SHA512 7d73d2113f8356385a91608a87a6e18bd0a02620aaeee5c93651cf1c1e84675a0b80a8e7e2723ee88f124d5d5def40d5d4eae9f401e33ebf9e59b5bf65d8163f
MD5 SHA1 SHA512

Submit Download

-ixsxtmo.pdb

Path C:\Users\Admin\AppData\Local\Temp\-ixsxtmo.pdb
Size 11KB
SHA256 6866519424b855c02ae270b6ea2521bca3e54d08d7928a2f5f6cbbd5dad5d420
MD5 032b1ef4b159801c1986a9524e34f867
SHA1 be29b8a399dab6301fd413d70310522829e313ca
SHA512 4f2d0bbc4a04432d4d00bb1025a6c7ca54c9d08716aabd207bf731a98cf05e9ea95734a5866414d0700601570f520012ff7644cd994607dba50f56beb3b5d04f
SSDEEP 48:zr/rp/tA629q0//y4FcA2vb3UeH29Fmk:zrFVA6Y/jFcA2D/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESD51B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD51B.tmp
Size 1KB
SHA256 4ea8d3c60cdb984f0a72e85479c2b1733757f286a1a24312c40f2a16ca501579
MD5 bae9500981798f358df7bdc9353d87fa
SHA1 cbac114341c07ad81d3b079b232ec8ca0726588e
SHA512 bcb210b4a3001030fc6ca32c88bcf76db212a3152d315d7f2552ab0ee9c67447be890995bac71cb2b155df24f035c20004370d034e5db0ed6fc5b2fb212afbe5
MD5 SHA1 SHA512

Submit Download

-ixsxtmo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\-ixsxtmo.0.cs
Size 896B
SHA256 c767ce6fc48b805e5229c7062f0d7663203494c737f2e7368b5116b9f7076d7c
MD5 2eb3029efcebceb96371607d15608c21
SHA1 a216045cba40aba3dc5add8a8c559bbd22e4ccee
SHA512 f02baa37fdf89a0c4685d66c62db730861f01f2a321f651a29abdcd9c86aaf147a2b3fcd994f7dff9af5fe6ca0e5160988554784c0f2707831f8fa2fb6a098d0
MD5 SHA1 SHA512

Submit Download

-ixsxtmo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\-ixsxtmo.cmdline
Size 481B
SHA256 babc713e46537e08e6578e061f5c3f6b287bb8dd2fec49eaf58fef87a615ddf7
MD5 5efcb480cf1ab27ee368a332a85af3d4
SHA1 84f62240aede04b21bef04fc0f3a2aa1fd480314
SHA512 e3b6f45b87013bd1227e0a50546cd18d68f843235f5869d50b356d5e657f5fb03f028770543890008a1484244a8693c12559cf9f889ac232be17ead697204e3d
MD5 SHA1 SHA512

Submit Download

CSCD51A.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD51A.tmp
Size 652B
SHA256 13001c8531f8037e16826487cddf85c45dc622e9c0189a6ac655dfa1dff04a65
MD5 899685bb925aad4c17633a3572386056
SHA1 cf1cb1b2824606669739560fd0dade00d1945cd8
SHA512 bf9d4645e1fa7a816d4a1a8c30ce9878904f245503515bc61fbca2bd8256b55e6156daf8c9a5a66c4b777ccd04f8f228c871dadb09dc996dcd27769d1f98e9e5
MD5 SHA1 SHA512

Submit Download

memory/2136-9-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download

memory/2136-10-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download

memory/2136-11-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download

memory/2136-5-0x000000001B200000-0x000000001B4E2000-memory.dmp

Download

memory/2136-8-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download

memory/2136-7-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download

memory/2136-6-0x00000000022F0000-0x00000000022F8000-memory.dmp

Download

memory/2136-25-0x0000000002580000-0x0000000002588000-memory.dmp

Download

memory/2136-4-0x000007FEF565E000-0x000007FEF565F000-memory.dmp

Download

memory/2136-28-0x000007FEF565E000-0x000007FEF565F000-memory.dmp

Download

memory/2136-29-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download