86d0b3c927b629f98bb72beebcdee8a831df152a6a2cedb0d65270c23069037c

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KWOTASIE.exe
Size 874KB
Sample240710-vt9jpssdqa
SHA256 86d0b3c927b629f98bb72beebcdee8a831df152a6a2cedb0d65270c23069037c
MD5 31ca0fd14af9b89c0aacd1a1c7dfd7e4
SHA1 67a33810ae059e722bbc5203fa644e5e550d5995
SHA512 708a32227d8109ff111c1fdbee5fce28101a40f5f6c5a9965e025b2b3e37d260aabbd84ddad76f3e2c566151a08ac71d5007126544af41077d8572060d39fa33
SSDEEP 24576:L3WbOu88VY2nrnN/n3CaHouNH6K8Yx1Lp:L3Wyu8OY8rn5yaI6aRY/p
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2168	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2168	powershell.exe
2644	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2168 set thread context of 2644	2168	powershell.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2168	powershell.exe
2168	powershell.exe
2168	powershell.exe
2168	powershell.exe
2168	powershell.exe
2168	powershell.exe
2168	powershell.exe
2168	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2168	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2168	772	KWOTASIE.exe	30
PID 772 wrote to memory of 2168	772	KWOTASIE.exe	30
PID 772 wrote to memory of 2168	772	KWOTASIE.exe	30
PID 772 wrote to memory of 2168	772	KWOTASIE.exe	30
PID 2168 wrote to memory of 2644	2168	powershell.exe	34
PID 2168 wrote to memory of 2644	2168	powershell.exe	34
PID 2168 wrote to memory of 2644	2168	powershell.exe	34
PID 2168 wrote to memory of 2644	2168	powershell.exe	34
PID 2168 wrote to memory of 2644	2168	powershell.exe	34
PID 2168 wrote to memory of 2644	2168	powershell.exe	34

C:\Users\Admin\AppData\Local\Temp\KWOTASIE.exe
"C:\Users\Admin\AppData\Local\Temp\KWOTASIE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden " $Atomicity=cat 'C:\Users\Admin\AppData\Local\forfrdelige\begyndervanskelighederne\femmers.For';$Cust=$Atomicity.substring(66672,3);.$Cust($Atomicity)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Antideflation.Cof

Path C:\Users\Admin\AppData\Local\forfrdelige\begyndervanskelighederne\Antideflation.Cof
Size 298KB
SHA256 79498c6cac498b40536c1397a8d44837d24d762be7fc62480461044c9bb803d2
MD5 53691d2a58bf592f1411a5733d9960e6
SHA1 7e08face46ad91159602b1f5ceec91bf870c54c6
SHA512 8862533db46846491aa7cb5e61bc73a3b0764ec5b7428b6756bfda9b1fabcad3340a74e4516d920266edf0131b88a428eacfe1234213329ad33b03c7dabc47b2
SSDEEP 6144:muwKIetVXkl3ZX114MICIHFcLCdUfejNefaGxrEHZQol:mFTetk3K3FcLCdyejYfvenl
MD5 SHA1 SHA512 SSDEEP

Submit Download

femmers.For

Path C:\Users\Admin\AppData\Local\forfrdelige\begyndervanskelighederne\femmers.For
Size 73KB
SHA256 617116095303a7e05250a30d7554893e20da987dc5184ef5abc911671bae7dc3
MD5 3b009c76c1efdec3d9160870ff0b5280
SHA1 b2c005cb0fd4cfed460bb7a910388a5394085240
SHA512 c334334c839cb91930232dfcad44d8d1711ea4bab4fa81aa2301e0c4bab181050a51c1d3833607734a131560dee8f5729404ec5f252c1e9f8aa1f4c8fc881bc1
SSDEEP 1536:4nzwTMCLiV2cdw0PKgiVG+6cmklgxgpl8ssl5dVDclag+z8NpE5UjwrwP:4nzwTMCGV2cdw0PKgiV3lmk4gU8laQ0s
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2168-15-0x0000000073CF1000-0x0000000073CF2000-memory.dmp

Download

memory/2168-16-0x0000000073CF0000-0x000000007429B000-memory.dmp

Download

memory/2168-19-0x0000000073CF0000-0x000000007429B000-memory.dmp

Download

memory/2168-18-0x0000000073CF0000-0x000000007429B000-memory.dmp

Download

memory/2168-17-0x0000000073CF0000-0x000000007429B000-memory.dmp

Download

memory/2168-22-0x0000000073CF0000-0x000000007429B000-memory.dmp

Download

memory/2168-24-0x0000000073CF0000-0x000000007429B000-memory.dmp

Download

memory/2168-26-0x0000000073CF0000-0x000000007429B000-memory.dmp

Download

memory/2168-25-0x00000000066A0000-0x0000000009496000-memory.dmp

Download

memory/2644-27-0x0000000000880000-0x00000000018E2000-memory.dmp

Download