Analysis
-
max time kernel
1799s -
max time network
1801s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
-
submitted
14-07-2024 20:00
General
-
Target
windows-solo.ps1
-
Size
511B
-
MD5
2b15e6dd22a7a73c8a72739110467e25
-
SHA1
1f93f8a881358cc8fc61b84bab504cb94cb7a294
-
SHA256
6e1543e7b97c225182680bac52f31ad86d2243979c30b37d8a932b9311c214c8
-
SHA512
efb67124e5f22e6f889c3da0feee4a1429db80a4c5c8a67ed04904a2415c4b27b3c200c5e7063ae32a4e40e1aa80fa69d80d64ec2ceef4312e73b207a0c239fe
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows-solo.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cpuminer\Cpuminer-opt-cpu-pool-win64\cpuminer.exe"C:\Users\Admin\AppData\Local\Temp\cpuminer\Cpuminer-opt-cpu-pool-win64\cpuminer.exe" -a yespowersugar -o stratum+tcp://yespowerSUGAR.mine.zergpool.com:6535 -u sugar1qnw8fvx7qa67v78qwpwp6yerk67quv7k6vhm9us -p c=SUGAR,mc=SUGAR,m=solo,ID=Windows2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.2MB
MD593050bd3206a0e6160e6fb65981c77bb
SHA1bd6c67028ebe18f5699fc361a2ef50fa67ce1e38
SHA256b2a519a0e3774ed74f364a05ed426ba0504334cf51089cea915ed6aaae8d8d7f
SHA512b78998e7b6c58bc6a53524701a12a474a0a1a46ca99384645795585941245c1e433be44fb06b202435b53c334e0d3a8edaac5ab14778facba977d2abb0045db8
-
Filesize
2.5MB
MD5e7853a869c7cc2d8755f22842aa563a4
SHA116172e911be9c2a6455cce0ede00c892454caa47
SHA2566d82dd1a8c5e217695f544d98d13f022f0a92a0178e659e80721eeea09ab8e5e
SHA5125504ccde15990826bdce91935b256b4080bbb5d5346c40b85fb3689d9eae9d0359255c901ccf693531bbcfeff242f9760905cf20201060340f5dffb740c358fa
-
Filesize
592KB
MD59c3fc89ea09f9e70a0e7003c829f434e
SHA157d1de8e5817ee055e6e1b0c65dbebd84211f412
SHA256110418ad0f0e3dd732a1b17212570e66bb7e43772e996ac198191b1ba8047612
SHA51224d4b51799e0f7fcd05f7466ffc2bc1a9fb6dbf014deb6b8e390559a37ce77f095822710d6060db74fc35213b347cebc9e0f8e27352b1c45f87e3db38ff2f7f5
-
Filesize
555KB
MD513bb780ab8f3a5fc096ea0f429452ca2
SHA104ab5162aa6d5937b8cf8e2d6b669904a5103dc2
SHA2563c8e18829b540547a67c5182bfe18504c5845b59d007f414d8489e9d7098715c
SHA512de845a6caed29691ce999bb4c5a3266da1841f89ab1159a9e02454a3c331520245c054aaa223774bf9b120e51e6eb98e5b7b41c67b4de7de44902e6fd938233d
-
Filesize
433KB
MD5fbfc9ec247464994e12c29a6b8db8f88
SHA106fd22f32b38f3575518411b0ef5dc3387e1aaaf
SHA2565efc15a25f932af31cadf3c4bd4c8cef1ff2d1df80db7ac91aeb06f1f54dfa28
SHA51201c62feba02715961c2096ac5cdc1acc2dc12dc0fd5c6c6b4c1657b7369c237667e0913da164747e26b0d28d4664fb0a1137b2323d799e2766d5f358f6271aca
-
Filesize
69KB
MD5de12ee463c12b0af3f07eed326be51fa
SHA1dc91c04fc82e5e60b7a152b8796374811da20ad9
SHA25623bd24e06f642fe0cd5408a5981ed65b47217b7afd4af0c6e1ee2508f3a25925
SHA512927379acc410b028895947cef733ffab86d3f587bc352334a740889d5888bfbadb57607fa4af4ce9328fa68b33abb514de46284f6de3b812d83ec114d648514c
-
Filesize
13.9MB
MD5974f6a89156b99f33a7103e5222137a5
SHA1967ad982011a35a98f2754c39001ec3af7749204
SHA256caaaa50b424fa02079534d9fcf04054ab1bc2b01c55a3dfa001d45a0539c9060
SHA5129e023d5ae453cffb7f825d6fc34da13fe740bacb910b2f2160b304060c67dd7c454aef4b4266bd0a7ce48f253e799273af0743f0d191fbf4c6d2186013f8f8b3
-
Filesize
290KB
MD51aca06d325b44ca427ea37b28a0497b5
SHA1990fd43449cb09db7a3f27da6143ac29aab1dfa2
SHA256f59b804babd80131c6f1b83b38bedefe0e3a9dafdd460269a0d7cc5f2317a48f
SHA5123fbf447884969652ab84e6d75d024d17bcdfe45126737ca5bb137d0156e3778b3abbe2d78b34c3b41d7ad826b4c413a08914f191afeaf5a9b4df8a58c33fa1f5
-
Filesize
110KB
MD52e08aee6cfaa50e99651b7d2fa293131
SHA128475b719d94d59bd2d49f6e255713160d497122
SHA2560dd643fa607a5a396ac842ee27ad4bf7764a91acac5d78b6020c4146bb2fd3f9
SHA5125797e4c72936d8b96171e0834d316586397b9df26eeee74e4e97a4608a34a4598656b7a02c273184aa2c6791859b4290855eb6890ebd8cbceeedda192a9ff08c
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
296KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
460KB
-
Filesize
11.8MB
-
Filesize
2.3MB
-
Filesize
100KB
-
Filesize
148KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB