Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
new.ps1
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
new.ps1
Resource
win10v2004-20240704-en
General
-
Target
new.ps1
-
Size
242KB
-
MD5
aa0d92ff6d6a1d18f6149f6d0ad03139
-
SHA1
6a33134bf530a61b764bf2287baf8fd0aea603ab
-
SHA256
f97c9c2965a77ff2bc0cfd54b6d6102d1aab09a4e66a3a19b1b633adfecb874f
-
SHA512
4fff4cb24271e0cd74d1eec0cca903abb8dfb8dc02f574f606a6e32a0e0181cc0c0a36884d1132932a154bf84440c10066b76972a990c3114fe3b088103b8ea3
-
SSDEEP
3072:OArNzTVf/Cjx58ri12gF5p2wgy36JEpG5bOxD0qc+8IZLFV2rKppKtpgEezbInG:OARx/65rp2wgy5psqxDrv2epEPezbInG
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\aeZaeCPwTj = "C:\\Users\\Admin\\AppData\\Roaming\\sehKCN.vbs" reg.exe -
pid Process 1748 powershell.exe 2828 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
pid Process 2716 reg.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1748 powershell.exe 1748 powershell.exe 1748 powershell.exe 2828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2900 1748 powershell.exe 31 PID 1748 wrote to memory of 2900 1748 powershell.exe 31 PID 1748 wrote to memory of 2900 1748 powershell.exe 31 PID 1748 wrote to memory of 2716 1748 powershell.exe 32 PID 1748 wrote to memory of 2716 1748 powershell.exe 32 PID 1748 wrote to memory of 2716 1748 powershell.exe 32 PID 2900 wrote to memory of 2828 2900 WScript.exe 33 PID 2900 wrote to memory of 2828 2900 WScript.exe 33 PID 2900 wrote to memory of 2828 2900 WScript.exe 33 PID 2828 wrote to memory of 2744 2828 powershell.exe 35 PID 2828 wrote to memory of 2744 2828 powershell.exe 35 PID 2828 wrote to memory of 2744 2828 powershell.exe 35
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\new.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\sehKCN.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exEc byPaSS -fiLe C:\Users\Admin\AppData\Roaming\VubuyfaVLadTy.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfqtwvw_.cmdline"4⤵PID:2744
-
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" Add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v aeZaeCPwTj /t REG_SZ /d C:\Users\Admin\AppData\Roaming\sehKCN.vbs /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD593419175d5de56c19a1dfe7b08efa321
SHA117790103040459293f2463416744a0f6d6526bfa
SHA256eaf2e1f8348059ad1a633f3b1977d20a780f53a6818b98bfcfc6e8b1b0194638
SHA512858d784a537ec1163b1eabc398d29c994b11853e44bf0a4792132f0c18537df35595767fe87396a9127e94a9c61f8c45278a7c1457462943f1c502d9b9189d21
-
Filesize
179KB
MD54f7d1b610c3154a148e0c3787cd8ec58
SHA181b7e5ea9dfcc05890f4e1574c8496a882291b86
SHA256ac2216db81d8b78950a74601205b638d8c9076e11903d13efe82cfd7fd126845
SHA5122b87fcb60288f3ff363ae7e054a3ab1be5b0f2a57a8e40996b94c9a934f962d14a1af1ca2f681a62fb08cf2dbb4bd9f69c2284322fbc185734b672478d89e68a
-
Filesize
2KB
MD5e5671d6bb4b7c012a32158fadea3c560
SHA1e05b3e5897ee5c521ac5f71210d203b146f8dc52
SHA256780df088a515769d8880fec4b674886aaa6969b923915dd20de59ac15fd5dc45
SHA51282965d196eae0be74a2b1a408ced7daa198d634cb35b5a4fe746eb8fdc5bb52d1134509bb4ab69a2cf8e6f8dd8b195fb07bca183ce260b0b492e89ebc3f997f0
-
Filesize
50KB
MD537f63f0f16b64ce7d236cd71617be27a
SHA1da34f42ade8f9a59819daf8f7aee8641ac759d9f
SHA2562df77f6e41d5554787155f07d45751ab3b4a62f49c350197cafdd3f3159beed3
SHA5123d6fec1c6269cdd0d9ca8ca8ba9a77fdf8b26d5cd3a936c578f3e7e7eb14efd0becc3aa64d4429deab03f03eeb07f6830d2f8d99e2dd6f330f62884149b0c518
-
Filesize
309B
MD5fd0f9a4a9eba7e59cc446e13d4bfac91
SHA1bdaf15054968fc7f2e253e4604f0aa7583883815
SHA2564c6f24529b9eac06deb41f5fb3e12a143b3b26bc130f0360f099f90d9a8296ba
SHA5128c36cc7004f924d7851917e1858f30981bc32d94f4be7e40ce25da59281bc70661c5a42889adb90e538f2887fed55d272c606fcdcc3688dd3a015b6b1cf52b98