bbe95e9ff2e1cd600ca63527b8b16a146cc1f28c77f415b0d9aa3c9aa972d12c

Resubmissions

10/06/2024, 12:50

240610-p28pgswblf3

10/06/2024, 12:45

240610-pzhehswajc3

10/06/2024, 12:41

240610-pw2nzsvhka3

10/06/2024, 12:34

240610-prx51awbpp3

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup_signed.ps1
Size 48KB
Sample240610-p28pgswblf
SHA256 3ca638018b2b3ca8d3183e3ee4d97d6a6914ce0f1b7046900a4aa1e1f30e0ce8
MD5 3fa0145de8ac0fdd37ff2a87ac822eae
SHA1 78f8e7420f1a6141d540b913bf763f7cd2fc0d99
SHA512 341be7e8266716a387e1aed9d9654f04eac2036301f3596b276d728400558855e5b610f89ebb4321e9a262e88fec2134c448f3bbece35c4eb03b4ac5cd47f408
SSDEEP 768:+CwyApqvg5c7qaw5Z0we5KqTeN3EHwyZqdlNiI68d1sQhDW9Q+Nn8JjxZEJvtrjH:z5KlCpQEKleH7+pg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4892	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	powershell.exe
4892	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1016	4892	powershell.exe	81
PID 4892 wrote to memory of 1016	4892	powershell.exe	81
PID 1016 wrote to memory of 2364	1016	csc.exe	82
PID 1016 wrote to memory of 2364	1016	csc.exe	82
PID 4892 wrote to memory of 1184	4892	powershell.exe	83
PID 4892 wrote to memory of 1184	4892	powershell.exe	83

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Setup_signed.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vhw3mf1t\vhw3mf1t.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3930.tmp" "c:\Users\Admin\AppData\Local\Temp\vhw3mf1t\CSC6D93B94DEAD044DFABCBE66FB694C783.TMP"
    3⤵
    PID:2364
- C:\Windows\system32\HOSTNAME.EXE
  "C:\Windows\system32\HOSTNAME.EXE"
  2⤵
  PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3930.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3930.tmp
Size 1KB
SHA256 8bdb37308148cd593ac749a0ccef0afd390998609cee549f381e6e7431ae62da
MD5 82edacce57b6ce87104470b7096acd0a
SHA1 fa0f2c878dfb2ed32a79fb221321269e3a7c4f31
SHA512 20634ed4c242107d16fc79eade24515f2ba76e05625224a857a11fe8ef4a1e390917b240ef5bf40e04eb13f14686cd93bc0e6997e13cf87262b9e1e5da7ef8ed
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_gfhzbbd0.umz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gfhzbbd0.umz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

vhw3mf1t.dll

Path C:\Users\Admin\AppData\Local\Temp\vhw3mf1t\vhw3mf1t.dll
Size 3KB
SHA256 1282f1d247231f0a5666ac776b922b320e43691c638ad36ed952f8c28359b144
MD5 c48460b56853c3bc2fe23608d9f3ec85
SHA1 af0c36c6d7907e7663865b660701ccfee65db355
SHA512 91bde21ed39c47a4f7fc197976c3b1dbdc87d668c1f5ff0aa641eeb8f33245c9c7e6ec5b9ccec3665b4544a6730957eb17a67d2ccc50a99606aa8401c47232a0
MD5 SHA1 SHA512

Submit Download

CSC6D93B94DEAD044DFABCBE66FB694C783.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vhw3mf1t\CSC6D93B94DEAD044DFABCBE66FB694C783.TMP
Size 652B
SHA256 8521539278bffc718740061d70b97d3e351c0cfe5563412c91fb7e0adfe29376
MD5 189732732c454fb6a359ec463745866e
SHA1 a4e933a0b3dd1d91144f1dfe1bd8746ad4bde30e
SHA512 18701b6d598439f265e38d745e285893569c734a64ee0582dfd0f9e8d31e8abaccadf7120c6b833527cfcf2bb04d86b8acec52ef01153b653eb226da645bf515
MD5 SHA1 SHA512

Submit Download

vhw3mf1t.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vhw3mf1t\vhw3mf1t.0.cs
Size 896B
SHA256 c767ce6fc48b805e5229c7062f0d7663203494c737f2e7368b5116b9f7076d7c
MD5 2eb3029efcebceb96371607d15608c21
SHA1 a216045cba40aba3dc5add8a8c559bbd22e4ccee
SHA512 f02baa37fdf89a0c4685d66c62db730861f01f2a321f651a29abdcd9c86aaf147a2b3fcd994f7dff9af5fe6ca0e5160988554784c0f2707831f8fa2fb6a098d0
MD5 SHA1 SHA512

Submit Download

vhw3mf1t.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vhw3mf1t\vhw3mf1t.cmdline
Size 560B
SHA256 be974d6b116cba8c11ab102d26d8dc95f2153bec2d734b3fa5d24f69e80b3fac
MD5 02237a41c854537e06de163f9f0390f0
SHA1 421c2109bc0303b658eb6572baf2df77beb914e0
SHA512 ec80e507fd21ebc9c2828f51ce9702ca186f88bbf4993e0af595f89106e2de46a0f7fb4dded8a03165549702a5d1e895dddea010452b358debd99e292a7451fb
MD5 SHA1 SHA512

Submit Download

memory/4892-12-0x00007FFF52840000-0x00007FFF53301000-memory.dmp

Download

memory/4892-13-0x00000197CD540000-0x00000197CD58A000-memory.dmp

Download

memory/4892-0-0x00007FFF52843000-0x00007FFF52845000-memory.dmp

Download

memory/4892-11-0x00007FFF52840000-0x00007FFF53301000-memory.dmp

Download

memory/4892-26-0x00000197CD270000-0x00000197CD278000-memory.dmp

Download

memory/4892-1-0x00000197B43A0000-0x00000197B43C2000-memory.dmp

Download

memory/4892-28-0x00007FFF52840000-0x00007FFF53301000-memory.dmp

Download

memory/4892-29-0x00007FFF52840000-0x00007FFF53301000-memory.dmp

Download

memory/4892-30-0x00007FFF52843000-0x00007FFF52845000-memory.dmp

Download

memory/4892-31-0x00007FFF52840000-0x00007FFF53301000-memory.dmp

Download