Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
new.ps1
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
new.ps1
Resource
win10v2004-20240704-en
General
-
Target
new.ps1
-
Size
242KB
-
MD5
aa0d92ff6d6a1d18f6149f6d0ad03139
-
SHA1
6a33134bf530a61b764bf2287baf8fd0aea603ab
-
SHA256
f97c9c2965a77ff2bc0cfd54b6d6102d1aab09a4e66a3a19b1b633adfecb874f
-
SHA512
4fff4cb24271e0cd74d1eec0cca903abb8dfb8dc02f574f606a6e32a0e0181cc0c0a36884d1132932a154bf84440c10066b76972a990c3114fe3b088103b8ea3
-
SSDEEP
3072:OArNzTVf/Cjx58ri12gF5p2wgy36JEpG5bOxD0qc+8IZLFV2rKppKtpgEezbInG:OARx/65rp2wgy5psqxDrv2epEPezbInG
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\aeZaeCPwTj = "C:\\Users\\Admin\\AppData\\Roaming\\sehKCN.vbs" reg.exe -
Processes:
powershell.exepowershell.exepid process 1748 powershell.exe 2828 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1748 powershell.exe 1748 powershell.exe 1748 powershell.exe 2828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
powershell.exeWScript.exepowershell.exedescription pid process target process PID 1748 wrote to memory of 2900 1748 powershell.exe WScript.exe PID 1748 wrote to memory of 2900 1748 powershell.exe WScript.exe PID 1748 wrote to memory of 2900 1748 powershell.exe WScript.exe PID 1748 wrote to memory of 2716 1748 powershell.exe reg.exe PID 1748 wrote to memory of 2716 1748 powershell.exe reg.exe PID 1748 wrote to memory of 2716 1748 powershell.exe reg.exe PID 2900 wrote to memory of 2828 2900 WScript.exe powershell.exe PID 2900 wrote to memory of 2828 2900 WScript.exe powershell.exe PID 2900 wrote to memory of 2828 2900 WScript.exe powershell.exe PID 2828 wrote to memory of 2744 2828 powershell.exe csc.exe PID 2828 wrote to memory of 2744 2828 powershell.exe csc.exe PID 2828 wrote to memory of 2744 2828 powershell.exe csc.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\new.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\sehKCN.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exEc byPaSS -fiLe C:\Users\Admin\AppData\Roaming\VubuyfaVLadTy.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfqtwvw_.cmdline"4⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" Add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v aeZaeCPwTj /t REG_SZ /d C:\Users\Admin\AppData\Roaming\sehKCN.vbs /f2⤵
- Adds Run key to start application
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD593419175d5de56c19a1dfe7b08efa321
SHA117790103040459293f2463416744a0f6d6526bfa
SHA256eaf2e1f8348059ad1a633f3b1977d20a780f53a6818b98bfcfc6e8b1b0194638
SHA512858d784a537ec1163b1eabc398d29c994b11853e44bf0a4792132f0c18537df35595767fe87396a9127e94a9c61f8c45278a7c1457462943f1c502d9b9189d21
-
C:\Users\Admin\AppData\Roaming\VubuyfaVLadTy.ps1Filesize
179KB
MD54f7d1b610c3154a148e0c3787cd8ec58
SHA181b7e5ea9dfcc05890f4e1574c8496a882291b86
SHA256ac2216db81d8b78950a74601205b638d8c9076e11903d13efe82cfd7fd126845
SHA5122b87fcb60288f3ff363ae7e054a3ab1be5b0f2a57a8e40996b94c9a934f962d14a1af1ca2f681a62fb08cf2dbb4bd9f69c2284322fbc185734b672478d89e68a
-
C:\Users\Admin\AppData\Roaming\sehKCN.vbsFilesize
2KB
MD5e5671d6bb4b7c012a32158fadea3c560
SHA1e05b3e5897ee5c521ac5f71210d203b146f8dc52
SHA256780df088a515769d8880fec4b674886aaa6969b923915dd20de59ac15fd5dc45
SHA51282965d196eae0be74a2b1a408ced7daa198d634cb35b5a4fe746eb8fdc5bb52d1134509bb4ab69a2cf8e6f8dd8b195fb07bca183ce260b0b492e89ebc3f997f0
-
\??\c:\Users\Admin\AppData\Local\Temp\mfqtwvw_.0.csFilesize
50KB
MD537f63f0f16b64ce7d236cd71617be27a
SHA1da34f42ade8f9a59819daf8f7aee8641ac759d9f
SHA2562df77f6e41d5554787155f07d45751ab3b4a62f49c350197cafdd3f3159beed3
SHA5123d6fec1c6269cdd0d9ca8ca8ba9a77fdf8b26d5cd3a936c578f3e7e7eb14efd0becc3aa64d4429deab03f03eeb07f6830d2f8d99e2dd6f330f62884149b0c518
-
\??\c:\Users\Admin\AppData\Local\Temp\mfqtwvw_.cmdlineFilesize
309B
MD5fd0f9a4a9eba7e59cc446e13d4bfac91
SHA1bdaf15054968fc7f2e253e4604f0aa7583883815
SHA2564c6f24529b9eac06deb41f5fb3e12a143b3b26bc130f0360f099f90d9a8296ba
SHA5128c36cc7004f924d7851917e1858f30981bc32d94f4be7e40ce25da59281bc70661c5a42889adb90e538f2887fed55d272c606fcdcc3688dd3a015b6b1cf52b98
-
memory/1748-15-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmpFilesize
9.6MB
-
memory/1748-4-0x000007FEF67EE000-0x000007FEF67EF000-memory.dmpFilesize
4KB
-
memory/1748-11-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmpFilesize
9.6MB
-
memory/1748-8-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmpFilesize
9.6MB
-
memory/1748-7-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmpFilesize
9.6MB
-
memory/1748-6-0x00000000023A0000-0x00000000023A8000-memory.dmpFilesize
32KB
-
memory/1748-5-0x000000001B860000-0x000000001BB42000-memory.dmpFilesize
2.9MB
-
memory/2828-21-0x000000001B5A0000-0x000000001B882000-memory.dmpFilesize
2.9MB
-
memory/2828-22-0x0000000001FF0000-0x0000000001FF8000-memory.dmpFilesize
32KB