Analysis
- max time kernel
432s - max time network
441s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
- submitted
12/07/2024, 23:52
General
- Target GjIeRXj.exe
- Size 9KB
- Sample240712-3wvgkaydqa
- SHA256 cc64a875031c75c7f20410d362651e4c886c2e12b13fd041dcf492471f8694ec
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GjIeRXj.exe"C:\Users\Admin\AppData\Local\Temp\GjIeRXj.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8EB3.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\GjIeRXj.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8FEC.tmp\batchfile.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exefindstr /v "^;;;===,,," "C:\Users\Admin\AppData\Local\Temp\8FEC.tmp\batchfile.bat"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Temp\8FEC.tmp\ps.ps1'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
b2e.exe
batchfile.bat
ps.ps1
__PSScriptPolicyTest_l5mlo2bv.jkh.ps1
memory/740-37-0x00000000079A0000-0x0000000007A3C000-memory.dmp
memory/740-49-0x00000000075D0000-0x00000000075EE000-memory.dmp
memory/740-18-0x0000000002D40000-0x0000000002D76000-memory.dmp
memory/740-19-0x00000000058B0000-0x0000000005EDA000-memory.dmp
memory/740-20-0x00000000057E0000-0x0000000005802000-memory.dmp
memory/740-21-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/740-22-0x0000000006040000-0x00000000060A6000-memory.dmp
memory/740-71-0x00000000087A0000-0x00000000087A8000-memory.dmp
memory/740-31-0x00000000060B0000-0x0000000006407000-memory.dmp
memory/740-32-0x0000000006540000-0x000000000655E000-memory.dmp
memory/740-33-0x0000000006590000-0x00000000065DC000-memory.dmp
memory/740-70-0x0000000008760000-0x000000000877A000-memory.dmp
memory/740-35-0x0000000007CD0000-0x000000000834A000-memory.dmp
memory/740-36-0x0000000006AA0000-0x0000000006ABA000-memory.dmp
memory/740-69-0x0000000008720000-0x0000000008735000-memory.dmp
memory/740-39-0x000000006FF50000-0x000000006FF9C000-memory.dmp
memory/740-38-0x00000000075F0000-0x0000000007624000-memory.dmp
memory/740-17-0x00000000735AE000-0x00000000735AF000-memory.dmp
memory/740-40-0x00000000700B0000-0x0000000070407000-memory.dmp
memory/740-50-0x0000000007A50000-0x0000000007AF4000-memory.dmp
memory/740-51-0x0000000007BB0000-0x0000000007BCC000-memory.dmp
memory/740-52-0x00000000075E0000-0x00000000075EA000-memory.dmp
memory/740-53-0x0000000007C20000-0x0000000007C46000-memory.dmp
memory/740-54-0x00000000089D0000-0x0000000008F76000-memory.dmp
memory/740-55-0x0000000008500000-0x0000000008592000-memory.dmp
memory/740-56-0x00000000700B0000-0x0000000070407000-memory.dmp
memory/740-65-0x00000000084F0000-0x00000000084FA000-memory.dmp
memory/740-66-0x00000000087C0000-0x0000000008856000-memory.dmp
memory/740-67-0x00000000086C0000-0x00000000086D1000-memory.dmp
memory/740-68-0x00000000086F0000-0x00000000086FE000-memory.dmp
memory/2960-9-0x0000000000400000-0x0000000000405000-memory.dmp
memory/2960-74-0x0000000000400000-0x0000000000405000-memory.dmp
memory/4900-0-0x0000000000400000-0x000000000040B000-memory.dmp
memory/4900-11-0x0000000000400000-0x000000000040B000-memory.dmp