Analysis
-
max time kernel
27s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 16:48
Static task
static1
Behavioral task
behavioral1
Sample
b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe
Resource
win7-20240704-en
General
-
Target
b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe
-
Size
797KB
-
MD5
114f1c23daae885f851b9cf1fdaf8457
-
SHA1
82338420d02452dfbd4bed8ed753e50739f27484
-
SHA256
b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32
-
SHA512
262650ad16731df09db9f6f5c816d45e6e2b9bf72a3d8af30ec121d3a1f0fc6e402da3117ecee472af777c7a6e1ac8fa5cd5e7c4ab7517fc7d2d61a9d9659ddb
-
SSDEEP
24576:jqxzXQRlUnZRJOU3MlrQvB5LcFFVo7S+vRSBJIZJi:jq91ZR0U3MlMvHcFFVo7EBAJi
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2772 powershell.exe 2060 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exepowershell.exepowershell.exepid process 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2772 powershell.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2060 powershell.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe Token: SeDebugPrivilege 2772 powershell.exe Token: SeDebugPrivilege 2060 powershell.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exedescription pid process target process PID 2388 wrote to memory of 2772 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe powershell.exe PID 2388 wrote to memory of 2772 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe powershell.exe PID 2388 wrote to memory of 2772 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe powershell.exe PID 2388 wrote to memory of 2772 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe powershell.exe PID 2388 wrote to memory of 2060 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe powershell.exe PID 2388 wrote to memory of 2060 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe powershell.exe PID 2388 wrote to memory of 2060 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe powershell.exe PID 2388 wrote to memory of 2060 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe powershell.exe PID 2388 wrote to memory of 2748 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe schtasks.exe PID 2388 wrote to memory of 2748 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe schtasks.exe PID 2388 wrote to memory of 2748 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe schtasks.exe PID 2388 wrote to memory of 2748 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe schtasks.exe PID 2388 wrote to memory of 2644 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2644 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2644 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2644 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2652 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2652 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2652 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2652 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2676 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2676 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2676 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2676 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2696 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2696 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2696 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2696 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2708 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2708 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2708 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe PID 2388 wrote to memory of 2708 2388 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vQYTRFwVF.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vQYTRFwVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CA1.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"C:\Users\Admin\AppData\Local\Temp\b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5CA1.tmpFilesize
1KB
MD5984ae8d7056cc7a11cee65bacc8374ce
SHA19c27a649b53fea3bb1cbec6af44971a419fbfe9c
SHA2560245f3fdb20e62700e68d1f6f600c688e9134c5b80f8d831537991a80ce3c7d3
SHA5124c925f3a2b2a408882eecd5fc722ee5295de33458ab66f947da0b4d9e03c49b76f3aaa2db2197416f7dcbc4cd4f981834ae1aad95e39e5f54c300cb529d9c1a7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD500c66e267187f2d3a347413285695b5d
SHA192be33e0e257c5c034bc84096c3840c296521f18
SHA256b796d2044136abb4654198c1c3d6918da3f309cff77d5e6a0655c1e38bf34ea4
SHA512055743d83718d44db19675c77e41bd5a6e6c6385bbfbd325bdd8e455550f90604df6f984cb503b11c7280dbf4a710c262bb0c74343b23b421ea5be84d6b8c6e1
-
memory/2388-0-0x0000000073B6E000-0x0000000073B6F000-memory.dmpFilesize
4KB
-
memory/2388-1-0x0000000000390000-0x000000000045A000-memory.dmpFilesize
808KB
-
memory/2388-2-0x0000000073B60000-0x000000007424E000-memory.dmpFilesize
6.9MB
-
memory/2388-3-0x0000000000340000-0x000000000035A000-memory.dmpFilesize
104KB
-
memory/2388-4-0x0000000000300000-0x0000000000308000-memory.dmpFilesize
32KB
-
memory/2388-5-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/2388-6-0x0000000000230000-0x00000000002CA000-memory.dmpFilesize
616KB
-
memory/2388-7-0x0000000073B6E000-0x0000000073B6F000-memory.dmpFilesize
4KB
-
memory/2388-10-0x0000000073B60000-0x000000007424E000-memory.dmpFilesize
6.9MB
-
memory/2388-21-0x0000000073B60000-0x000000007424E000-memory.dmpFilesize
6.9MB