Analysis
-
max time kernel
1758s -
max time network
1772s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-07-2024 19:10
Static task
static1
Behavioral task
behavioral1
Sample
windows.ps1
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
windows.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
windows.ps1
Resource
win11-20240709-en
General
-
Target
windows.ps1
-
Size
467B
-
MD5
63f6c82077c4c39d6d9101409b16a668
-
SHA1
09d1960993c90f39607f437a2106b65db7aeae29
-
SHA256
18284686feab2a0753bd0059a64004d8b86bb47048065cba12d323efbb6cc891
-
SHA512
3bbf47af04fae3e7fd921bf1319e652c879d6132d4ea495cb7d6f47a38b9a4fb09f7be4af14c2d0c7357febd893c16639268dc82ec3b9194d0d4dc54723e1a34
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 4572 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1788 ccminer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 raw.githubusercontent.com 1 raw.githubusercontent.com -
pid Process 4572 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4572 powershell.exe 4572 powershell.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 4572 powershell.exe Token: SeIncreaseQuotaPrivilege 4572 powershell.exe Token: SeSecurityPrivilege 4572 powershell.exe Token: SeTakeOwnershipPrivilege 4572 powershell.exe Token: SeLoadDriverPrivilege 4572 powershell.exe Token: SeSystemProfilePrivilege 4572 powershell.exe Token: SeSystemtimePrivilege 4572 powershell.exe Token: SeProfSingleProcessPrivilege 4572 powershell.exe Token: SeIncBasePriorityPrivilege 4572 powershell.exe Token: SeCreatePagefilePrivilege 4572 powershell.exe Token: SeBackupPrivilege 4572 powershell.exe Token: SeRestorePrivilege 4572 powershell.exe Token: SeShutdownPrivilege 4572 powershell.exe Token: SeDebugPrivilege 4572 powershell.exe Token: SeSystemEnvironmentPrivilege 4572 powershell.exe Token: SeRemoteShutdownPrivilege 4572 powershell.exe Token: SeUndockPrivilege 4572 powershell.exe Token: SeManageVolumePrivilege 4572 powershell.exe Token: 33 4572 powershell.exe Token: 34 4572 powershell.exe Token: 35 4572 powershell.exe Token: 36 4572 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4572 wrote to memory of 1788 4572 powershell.exe 84 PID 4572 wrote to memory of 1788 4572 powershell.exe 84 PID 1788 wrote to memory of 692 1788 ccminer.exe 85 PID 1788 wrote to memory of 692 1788 ccminer.exe 85
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe"C:\Users\Admin\AppData\Local\Temp\ccminer\ccminer\ccminer.exe" -a verus -o stratum+tcp://de.vipor.net:5040 -u RHACKERwSVgjTvV4vNiTjmrkLTD7a92ALD.Windows -p x -t 22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:692
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
652KB
MD5153e4364a395b282b983dfc2c5884105
SHA19147a6afa63bd7d7e451c693e362730c692781e1
SHA2566a1077166de9d1cc6fceaf6da6f8c5e1c8d9d5f99f3ab845b9790fc6d395d896
SHA512378fe8b9ae243d5844243999a909ab45216920d63149b39be521e5212533f0dc30e8620c6285738e1100618f44d1576b3ccd9aa27b0e65b29a3ca1937047173d