Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 22:37 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe
Resource
win7-20240705-en
4 signatures
300 seconds
General
-
Target
8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe
-
Size
3.9MB
-
MD5
c8de9399c22a91d81bc9ecbe502556c1
-
SHA1
5c70471cb9b4278052561db539b2004fa02b2e90
-
SHA256
8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae
-
SHA512
b699d636a745596591dde641f0bd4d27a7b8b98287390f39e5d61c9f1faccec975c100ec7d41176eb6536dc59cbc9258addbd69fd9014f0480d3e23f966399a9
-
SSDEEP
49152:JOb699GhOeeYrHhxNg0Dobuh9CY501gFji3o8SIP1qJ5+BXldQJmnt7wBHQ:L9vYrdnfsSIAJYBXlVwBw
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2760 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2760 powershell.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2760 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 31 PID 2224 wrote to memory of 2760 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 31 PID 2224 wrote to memory of 2760 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 31 PID 2224 wrote to memory of 2648 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 33 PID 2224 wrote to memory of 2648 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 33 PID 2224 wrote to memory of 2648 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 33 PID 2224 wrote to memory of 2648 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 33 PID 2224 wrote to memory of 2568 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 34 PID 2224 wrote to memory of 2568 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 34 PID 2224 wrote to memory of 2568 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 34 PID 2224 wrote to memory of 2568 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 34 PID 2224 wrote to memory of 2632 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 35 PID 2224 wrote to memory of 2632 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 35 PID 2224 wrote to memory of 2632 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 35 PID 2224 wrote to memory of 2632 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 35 PID 2224 wrote to memory of 2560 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 36 PID 2224 wrote to memory of 2560 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 36 PID 2224 wrote to memory of 2560 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 36 PID 2224 wrote to memory of 2560 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 36 PID 2224 wrote to memory of 2812 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 37 PID 2224 wrote to memory of 2812 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 37 PID 2224 wrote to memory of 2812 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 37 PID 2224 wrote to memory of 2812 2224 8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe"C:\Users\Admin\AppData\Local\Temp\8912a860fea905932645a87fb22455057e7fee4aa6f64a3cf0a2ef28e810f6ae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"2⤵PID:2648
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe"2⤵PID:2568
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵PID:2632
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe"2⤵PID:2560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe"2⤵PID:2812
-