d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe
Size

531KB
MD5

f374e44cda0ddf8355ad99829308e994
SHA1

1576076d2d7fdd8c7c6b80c53f91e3b28ce7093a
SHA256

d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877
SHA512

037f42b6158b5712e3e0f4ce48ecfdaeb25bfd50ab8a451a87de56756123a63e1f77eade8b1f4de6d496e032353d220fd40f6e2eb60cf297f9b5f1d483305f9f
SSDEEP

12288:s49hXhKuYmmYH2pOaHeoX6re6bCCzMRK92B:n9hxKuPc3eoX+e6pMM2

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe
2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Garuda56\sonni.lnk	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2696	powershell.exe
2620	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	powershell.exe
2620	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2696	2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	28
PID 2008 wrote to memory of 2696	2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	28
PID 2008 wrote to memory of 2696	2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	28
PID 2008 wrote to memory of 2696	2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	28
PID 2008 wrote to memory of 2620	2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	30
PID 2008 wrote to memory of 2620	2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	30
PID 2008 wrote to memory of 2620	2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	30
PID 2008 wrote to memory of 2620	2008	d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe	30

C:\Users\Admin\AppData\Local\Temp\d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe
"C:\Users\Admin\AppData\Local\Temp\d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle minimized "$Ufortalt=Get-Content 'C:\Users\Admin\AppData\Local\heftig\menusystemets\repressurize\Halvaarets.Div44';$Overreliant=$Ufortalt.SubString(51466,3);.$Overreliant($Ufortalt)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle minimized "$Ufortalt=Get-Content 'C:\Users\Admin\AppData\Local\heftig\menusystemets\repressurize\Halvaarets.Div44';$Overreliant=$Ufortalt.SubString(51466,3);.$Overreliant($Ufortalt)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
0793c3b7f4eeafd9f4527e194493fcba

SHA1
b5af8bee2da12049e8a3c89f559322fca7a46d70

SHA256
a3dfb45ce5a22f2ce80812cd518979f7167e9864c616f69d74fafd1424efa9e4

SHA512
b3fe24db11f0e44e1e4a38a8424dc5f0ff7119873ea99272d98944bb5897e8ecae4e9909bd3a8349aa6722281f2a5a6f723092d0a26dee5e4956357860e30b8d

Download Submit
\Users\Admin\AppData\Local\Temp\nsd171A.tmp\nsExec.dll

Filesize
6KB

MD5
b2639b996a3d69541c78642772283e9f

SHA1
e8a0c678708b8b625234a3ac502e37940ad2992f

SHA256
79aa4f0daf303b02bfcf0306e690378e050003e42c7c9d3e1bd5ad62fb2f3a21

SHA512
fabd2f9dd6ff8887cde99c9ccb7c755722daed0e6d7d332e1811b7a4a0f10daaad3ab750fb90838fdcc8049bda49f0cb84283e007c48e54b117b4de41c321815

Download Submit
memory/2696-19-0x0000000074041000-0x0000000074042000-memory.dmp

Filesize
4KB

Download
memory/2696-20-0x0000000074040000-0x00000000745EB000-memory.dmp

Filesize
5.7MB

Download
memory/2696-21-0x0000000074040000-0x00000000745EB000-memory.dmp

Filesize
5.7MB

Download
memory/2696-22-0x0000000074040000-0x00000000745EB000-memory.dmp

Filesize
5.7MB

Download
memory/2696-23-0x0000000074040000-0x00000000745EB000-memory.dmp

Filesize
5.7MB

Download