Analysis
-
max time kernel
315s -
max time network
1792s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
20-07-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
windows.ps1
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
windows.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
windows.ps1
Resource
win11-20240709-en
General
-
Target
windows.ps1
-
Size
467B
-
MD5
63f6c82077c4c39d6d9101409b16a668
-
SHA1
09d1960993c90f39607f437a2106b65db7aeae29
-
SHA256
18284686feab2a0753bd0059a64004d8b86bb47048065cba12d323efbb6cc891
-
SHA512
3bbf47af04fae3e7fd921bf1319e652c879d6132d4ea495cb7d6f47a38b9a4fb09f7be4af14c2d0c7357febd893c16639268dc82ec3b9194d0d4dc54723e1a34
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 1300 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 5096 ccminer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com -
pid Process 1300 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1300 powershell.exe 1300 powershell.exe 1300 powershell.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 1300 powershell.exe Token: SeIncreaseQuotaPrivilege 1300 powershell.exe Token: SeSecurityPrivilege 1300 powershell.exe Token: SeTakeOwnershipPrivilege 1300 powershell.exe Token: SeLoadDriverPrivilege 1300 powershell.exe Token: SeSystemProfilePrivilege 1300 powershell.exe Token: SeSystemtimePrivilege 1300 powershell.exe Token: SeProfSingleProcessPrivilege 1300 powershell.exe Token: SeIncBasePriorityPrivilege 1300 powershell.exe Token: SeCreatePagefilePrivilege 1300 powershell.exe Token: SeBackupPrivilege 1300 powershell.exe Token: SeRestorePrivilege 1300 powershell.exe Token: SeShutdownPrivilege 1300 powershell.exe Token: SeDebugPrivilege 1300 powershell.exe Token: SeSystemEnvironmentPrivilege 1300 powershell.exe Token: SeRemoteShutdownPrivilege 1300 powershell.exe Token: SeUndockPrivilege 1300 powershell.exe Token: SeManageVolumePrivilege 1300 powershell.exe Token: 33 1300 powershell.exe Token: 34 1300 powershell.exe Token: 35 1300 powershell.exe Token: 36 1300 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1300 wrote to memory of 5096 1300 powershell.exe 72 PID 1300 wrote to memory of 5096 1300 powershell.exe 72 PID 5096 wrote to memory of 4540 5096 ccminer.exe 73 PID 5096 wrote to memory of 4540 5096 ccminer.exe 73
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe"C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe" -a verus -o stratum+tcp://de.vipor.net:5040 -u RHACKERwSVgjTvV4vNiTjmrkLTD7a92ALD.Windows -p x -t 22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4540
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
652KB
MD5153e4364a395b282b983dfc2c5884105
SHA19147a6afa63bd7d7e451c693e362730c692781e1
SHA2566a1077166de9d1cc6fceaf6da6f8c5e1c8d9d5f99f3ab845b9790fc6d395d896
SHA512378fe8b9ae243d5844243999a909ab45216920d63149b39be521e5212533f0dc30e8620c6285738e1100618f44d1576b3ccd9aa27b0e65b29a3ca1937047173d