Analysis
-
max time kernel
1628s -
max time network
1794s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/07/2024, 14:52
Static task
static1
Behavioral task
behavioral1
Sample
windows.ps1
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
windows.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
windows.ps1
Resource
win11-20240709-en
General
-
Target
windows.ps1
-
Size
466B
-
MD5
ff6da2ea1f76b641b39056461b10b799
-
SHA1
7de1626e6a90871e755489ee289d025e3fc73b94
-
SHA256
2771f6466a88076a32b495b14462c453f12b702a4219e0866ea097d235d28e53
-
SHA512
2a19070efee58d2c7f4733657e3c38e3f78805cd5a11e807cd8e71397bcbadc1182e7b08cb3200ef42040c699b65335f8777d4708d3883ab814cdf06b384cd0a
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 3652 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2764 ccminer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com -
pid Process 3652 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3652 powershell.exe 3652 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3652 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3652 wrote to memory of 2764 3652 powershell.exe 84 PID 3652 wrote to memory of 2764 3652 powershell.exe 84 PID 2764 wrote to memory of 4344 2764 ccminer.exe 85 PID 2764 wrote to memory of 4344 2764 ccminer.exe 85
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe"C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe" -a verus -o stratum+tcp://de.vipor.net:5040 -u RHACKERwSVgjTvV4vNiTjmrkLTD7a92ALD.Windows -p x -t 122⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4344
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
652KB
MD5153e4364a395b282b983dfc2c5884105
SHA19147a6afa63bd7d7e451c693e362730c692781e1
SHA2566a1077166de9d1cc6fceaf6da6f8c5e1c8d9d5f99f3ab845b9790fc6d395d896
SHA512378fe8b9ae243d5844243999a909ab45216920d63149b39be521e5212533f0dc30e8620c6285738e1100618f44d1576b3ccd9aa27b0e65b29a3ca1937047173d