Analysis
-
max time kernel
1409s -
max time network
1786s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 13:17
Static task
static1
Behavioral task
behavioral1
Sample
windows.ps1
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
windows.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
windows.ps1
Resource
win11-20240709-en
General
-
Target
windows.ps1
-
Size
467B
-
MD5
63f6c82077c4c39d6d9101409b16a668
-
SHA1
09d1960993c90f39607f437a2106b65db7aeae29
-
SHA256
18284686feab2a0753bd0059a64004d8b86bb47048065cba12d323efbb6cc891
-
SHA512
3bbf47af04fae3e7fd921bf1319e652c879d6132d4ea495cb7d6f47a38b9a4fb09f7be4af14c2d0c7357febd893c16639268dc82ec3b9194d0d4dc54723e1a34
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 20 1856 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 644 ccminer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 20 raw.githubusercontent.com 19 raw.githubusercontent.com -
pid Process 1856 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1856 powershell.exe 1856 powershell.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 1856 powershell.exe Token: SeIncreaseQuotaPrivilege 1856 powershell.exe Token: SeSecurityPrivilege 1856 powershell.exe Token: SeTakeOwnershipPrivilege 1856 powershell.exe Token: SeLoadDriverPrivilege 1856 powershell.exe Token: SeSystemProfilePrivilege 1856 powershell.exe Token: SeSystemtimePrivilege 1856 powershell.exe Token: SeProfSingleProcessPrivilege 1856 powershell.exe Token: SeIncBasePriorityPrivilege 1856 powershell.exe Token: SeCreatePagefilePrivilege 1856 powershell.exe Token: SeBackupPrivilege 1856 powershell.exe Token: SeRestorePrivilege 1856 powershell.exe Token: SeShutdownPrivilege 1856 powershell.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeSystemEnvironmentPrivilege 1856 powershell.exe Token: SeRemoteShutdownPrivilege 1856 powershell.exe Token: SeUndockPrivilege 1856 powershell.exe Token: SeManageVolumePrivilege 1856 powershell.exe Token: 33 1856 powershell.exe Token: 34 1856 powershell.exe Token: 35 1856 powershell.exe Token: 36 1856 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 644 1856 powershell.exe 92 PID 1856 wrote to memory of 644 1856 powershell.exe 92 PID 644 wrote to memory of 3924 644 ccminer.exe 93 PID 644 wrote to memory of 3924 644 ccminer.exe 93
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe"C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe" -a verus -o stratum+tcp://de.vipor.net:5040 -u RHACKERwSVgjTvV4vNiTjmrkLTD7a92ALD.Windows -p x -t 22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3924
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
652KB
MD5153e4364a395b282b983dfc2c5884105
SHA19147a6afa63bd7d7e451c693e362730c692781e1
SHA2566a1077166de9d1cc6fceaf6da6f8c5e1c8d9d5f99f3ab845b9790fc6d395d896
SHA512378fe8b9ae243d5844243999a909ab45216920d63149b39be521e5212533f0dc30e8620c6285738e1100618f44d1576b3ccd9aa27b0e65b29a3ca1937047173d