Analysis
-
max time kernel
1796s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 14:47
Static task
static1
Behavioral task
behavioral1
Sample
windows.ps1
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
windows.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
windows.ps1
Resource
win11-20240709-en
General
-
Target
windows.ps1
-
Size
467B
-
MD5
63f6c82077c4c39d6d9101409b16a668
-
SHA1
09d1960993c90f39607f437a2106b65db7aeae29
-
SHA256
18284686feab2a0753bd0059a64004d8b86bb47048065cba12d323efbb6cc891
-
SHA512
3bbf47af04fae3e7fd921bf1319e652c879d6132d4ea495cb7d6f47a38b9a4fb09f7be4af14c2d0c7357febd893c16639268dc82ec3b9194d0d4dc54723e1a34
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 24 2152 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2000 ccminer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 23 raw.githubusercontent.com 24 raw.githubusercontent.com -
pid Process 2152 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2152 powershell.exe 2152 powershell.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2152 powershell.exe Token: SeIncreaseQuotaPrivilege 2152 powershell.exe Token: SeSecurityPrivilege 2152 powershell.exe Token: SeTakeOwnershipPrivilege 2152 powershell.exe Token: SeLoadDriverPrivilege 2152 powershell.exe Token: SeSystemProfilePrivilege 2152 powershell.exe Token: SeSystemtimePrivilege 2152 powershell.exe Token: SeProfSingleProcessPrivilege 2152 powershell.exe Token: SeIncBasePriorityPrivilege 2152 powershell.exe Token: SeCreatePagefilePrivilege 2152 powershell.exe Token: SeBackupPrivilege 2152 powershell.exe Token: SeRestorePrivilege 2152 powershell.exe Token: SeShutdownPrivilege 2152 powershell.exe Token: SeDebugPrivilege 2152 powershell.exe Token: SeSystemEnvironmentPrivilege 2152 powershell.exe Token: SeRemoteShutdownPrivilege 2152 powershell.exe Token: SeUndockPrivilege 2152 powershell.exe Token: SeManageVolumePrivilege 2152 powershell.exe Token: 33 2152 powershell.exe Token: 34 2152 powershell.exe Token: 35 2152 powershell.exe Token: 36 2152 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2000 2152 powershell.exe 95 PID 2152 wrote to memory of 2000 2152 powershell.exe 95 PID 2000 wrote to memory of 1052 2000 ccminer.exe 96 PID 2000 wrote to memory of 1052 2000 ccminer.exe 96
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe"C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe" -a verus -o stratum+tcp://de.vipor.net:5040 -u RHACKERwSVgjTvV4vNiTjmrkLTD7a92ALD.Windows -p x -t 22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1052
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
652KB
MD5153e4364a395b282b983dfc2c5884105
SHA19147a6afa63bd7d7e451c693e362730c692781e1
SHA2566a1077166de9d1cc6fceaf6da6f8c5e1c8d9d5f99f3ab845b9790fc6d395d896
SHA512378fe8b9ae243d5844243999a909ab45216920d63149b39be521e5212533f0dc30e8620c6285738e1100618f44d1576b3ccd9aa27b0e65b29a3ca1937047173d