7d27d6d1580326ac63d04df92ed0f054df38dae95f79fd88d62501ab6e994149

General

Target

new.ps1
Size

242KB
MD5

aa0d92ff6d6a1d18f6149f6d0ad03139
SHA1

6a33134bf530a61b764bf2287baf8fd0aea603ab
SHA256

f97c9c2965a77ff2bc0cfd54b6d6102d1aab09a4e66a3a19b1b633adfecb874f
SHA512

4fff4cb24271e0cd74d1eec0cca903abb8dfb8dc02f574f606a6e32a0e0181cc0c0a36884d1132932a154bf84440c10066b76972a990c3114fe3b088103b8ea3
SSDEEP

3072:OArNzTVf/Cjx58ri12gF5p2wgy36JEpG5bOxD0qc+8IZLFV2rKppKtpgEezbInG:OARx/65rp2wgy5psqxDrv2epEPezbInG

Score

6^/10

execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\aeZaeCPwTj = "C:\\Users\\Admin\\AppData\\Roaming\\sehKCN.vbs"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1748	powershell.exe
2828	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2716	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1748	powershell.exe
1748	powershell.exe
1748	powershell.exe
2828	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2900	1748	powershell.exe	31
PID 1748 wrote to memory of 2900	1748	powershell.exe	31
PID 1748 wrote to memory of 2900	1748	powershell.exe	31
PID 1748 wrote to memory of 2716	1748	powershell.exe	32
PID 1748 wrote to memory of 2716	1748	powershell.exe	32
PID 1748 wrote to memory of 2716	1748	powershell.exe	32
PID 2900 wrote to memory of 2828	2900	WScript.exe	33
PID 2900 wrote to memory of 2828	2900	WScript.exe	33
PID 2900 wrote to memory of 2828	2900	WScript.exe	33
PID 2828 wrote to memory of 2744	2828	powershell.exe	35
PID 2828 wrote to memory of 2744	2828	powershell.exe	35
PID 2828 wrote to memory of 2744	2828	powershell.exe	35

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\new.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\sehKCN.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exEc byPaSS -fiLe C:\Users\Admin\AppData\Roaming\VubuyfaVLadTy.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfqtwvw_.cmdline"
      4⤵
      PID:2744
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" Add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v aeZaeCPwTj /t REG_SZ /d C:\Users\Admin\AppData\Roaming\sehKCN.vbs /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
93419175d5de56c19a1dfe7b08efa321

SHA1
17790103040459293f2463416744a0f6d6526bfa

SHA256
eaf2e1f8348059ad1a633f3b1977d20a780f53a6818b98bfcfc6e8b1b0194638

SHA512
858d784a537ec1163b1eabc398d29c994b11853e44bf0a4792132f0c18537df35595767fe87396a9127e94a9c61f8c45278a7c1457462943f1c502d9b9189d21

Download Submit
C:\Users\Admin\AppData\Roaming\VubuyfaVLadTy.ps1

Filesize
179KB

MD5
4f7d1b610c3154a148e0c3787cd8ec58

SHA1
81b7e5ea9dfcc05890f4e1574c8496a882291b86

SHA256
ac2216db81d8b78950a74601205b638d8c9076e11903d13efe82cfd7fd126845

SHA512
2b87fcb60288f3ff363ae7e054a3ab1be5b0f2a57a8e40996b94c9a934f962d14a1af1ca2f681a62fb08cf2dbb4bd9f69c2284322fbc185734b672478d89e68a

Download Submit
C:\Users\Admin\AppData\Roaming\sehKCN.vbs

Filesize
2KB

MD5
e5671d6bb4b7c012a32158fadea3c560

SHA1
e05b3e5897ee5c521ac5f71210d203b146f8dc52

SHA256
780df088a515769d8880fec4b674886aaa6969b923915dd20de59ac15fd5dc45

SHA512
82965d196eae0be74a2b1a408ced7daa198d634cb35b5a4fe746eb8fdc5bb52d1134509bb4ab69a2cf8e6f8dd8b195fb07bca183ce260b0b492e89ebc3f997f0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mfqtwvw_.0.cs

Filesize
50KB

MD5
37f63f0f16b64ce7d236cd71617be27a

SHA1
da34f42ade8f9a59819daf8f7aee8641ac759d9f

SHA256
2df77f6e41d5554787155f07d45751ab3b4a62f49c350197cafdd3f3159beed3

SHA512
3d6fec1c6269cdd0d9ca8ca8ba9a77fdf8b26d5cd3a936c578f3e7e7eb14efd0becc3aa64d4429deab03f03eeb07f6830d2f8d99e2dd6f330f62884149b0c518

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mfqtwvw_.cmdline

Filesize
309B

MD5
fd0f9a4a9eba7e59cc446e13d4bfac91

SHA1
bdaf15054968fc7f2e253e4604f0aa7583883815

SHA256
4c6f24529b9eac06deb41f5fb3e12a143b3b26bc130f0360f099f90d9a8296ba

SHA512
8c36cc7004f924d7851917e1858f30981bc32d94f4be7e40ce25da59281bc70661c5a42889adb90e538f2887fed55d272c606fcdcc3688dd3a015b6b1cf52b98

Download Submit
memory/1748-15-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmp

Filesize
9.6MB

Download
memory/1748-4-0x000007FEF67EE000-0x000007FEF67EF000-memory.dmp

Filesize
4KB

Download
memory/1748-11-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmp

Filesize
9.6MB

Download
memory/1748-8-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmp

Filesize
9.6MB

Download
memory/1748-7-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmp

Filesize
9.6MB

Download
memory/1748-6-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/1748-5-0x000000001B860000-0x000000001BB42000-memory.dmp

Filesize
2.9MB

Download
memory/2828-21-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2828-22-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads