ec7d6975587d8dd4effb5727882b1fbb867766d4df73ec304c88d27362ce6ace

General

Target

2.ps1
Size

1002KB
MD5

53c4c7466cebb3357a4bf5fdde6e03bd
SHA1

3ae57e66c6651b2c35b873db5de86b87ccc969ad
SHA256

ec7d6975587d8dd4effb5727882b1fbb867766d4df73ec304c88d27362ce6ace
SHA512

aa7a49bde2e30748853b66c772d5bc72372699d52a0d4806d373e870eaa0488ba6ff7b92669e15c9b0180f4cfebd45e698a75b514512b6eddb338dfaf2d2a75e
SSDEEP

24576:TawjBUo3v/AOhx415r2X0Kin4clpSeuoZ+tF0USjpMmaXBxwP0oOGAlLRqkbx2yY:e

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2240	powershell.exe
324	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	powershell.exe
324	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	324	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1272	2872	taskeng.exe	33
PID 2872 wrote to memory of 1272	2872	taskeng.exe	33
PID 2872 wrote to memory of 1272	2872	taskeng.exe	33
PID 1272 wrote to memory of 2876	1272	WScript.exe	34
PID 1272 wrote to memory of 2876	1272	WScript.exe	34
PID 1272 wrote to memory of 2876	1272	WScript.exe	34
PID 2876 wrote to memory of 324	2876	cmd.exe	36
PID 2876 wrote to memory of 324	2876	cmd.exe	36
PID 2876 wrote to memory of 324	2876	cmd.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\system32\taskeng.exe
taskeng.exe {F3CFED76-012B-4C3D-991F-B7B29F30542B} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\WScript.exe
  C:\Windows\System32\WScript.exe "C:\Users\Public\wingro8.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\System32\cmd.exe
    cmd /c ""C:\Users\Public\wingro8.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\wingro8.ps1'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
50d4a99b69cfffe7d2d266a1409a74f3

SHA1
502c672e96d215fc401dc756df1b8f277ba84eee

SHA256
ab4b5d0ae90c3dfcf0817ced53e1401a14c89f36f3d8134e67924abdfa99f028

SHA512
95a9d5cf086c24d3802b845139eee0965f74ef0ca77421e15b0bb4e8e84ca622ba28d18e056a86624891819984bd02936b34dd73b8107ed336f7729648b5feb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O0P0OEF8OZ0CEYQ7PA4U.temp

Filesize
7KB

MD5
45da11067f7107dde921b21a1748fe51

SHA1
f31041c1cd08b3b70007d93623620c67074dd0f8

SHA256
f3df444e078eb6180c2f698fa69fc6551adfd590f3a979be9d7b250fc5853147

SHA512
54892535ee95e40c93de87db8f23a5a4b1b76240e7bc1b97e3a5b2b241f2af708119eef62a727b9a8cae55b82f16e9fc00713127e72578db8e0da9bb75612caf

Download Submit
C:\Users\Public\wingro8.bat

Filesize
204B

MD5
9ae3fd9aa024c8c635043f25e14e4582

SHA1
346bdf6d3fb90733b29e4b0679eed419d2337d8a

SHA256
08eb7706a9e1efa8a68e0174bc5d62fd48282ffafc561819c3bc87784a80e73f

SHA512
b4a87e683517cdfc1df43a08b238844bac0319be234ccfddb1ba0c55bc321d5f3b592a7ecd795370d735c629ff2122d9a6405c181a16128606ba4b26c1f67af2

Download Submit
C:\Users\Public\wingro8.ps1

Filesize
1000KB

MD5
a7c519fa08aa6c0e88292f403244958d

SHA1
66aa43c3d645041957e7da8ad263c6c8ac21875f

SHA256
6b69b5238db51c77517e5ad018160b9d1be9b9d6af217033b4cf0648e4dfe1fd

SHA512
f621dc60aed94d8571a75b9f3ef83831de09fa1baebd21e12d476c67315745b6974bd76c163c623ee765f7e181da4291aa298574397782020e0b4585911fb1bd

Download Submit
C:\Users\Public\wingro8.vbs

Filesize
689B

MD5
aeee1749af12130d3f8c69f286d82904

SHA1
1199175f300c2249c1e6fedb28efa44acffa88b1

SHA256
40dd27ce5d1b906557495317c0c0164cce12baab5dae79028b1539a65a9caf2b

SHA512
f8e944b7de50ef6200606f334b82216ea177bea391b3464bacda0db44395a346994cdb26f1bba4c83e6044f88b76cad87d89179ced0ea09114d15aeab49fffec

Download Submit
memory/324-26-0x0000000002970000-0x00000000029A4000-memory.dmp

Filesize
208KB

Download
memory/324-23-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/324-24-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2240-9-0x000007FEF6700000-0x000007FEF709D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-15-0x000007FEF6700000-0x000007FEF709D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-11-0x000007FEF6700000-0x000007FEF709D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-5-0x000000001B470000-0x000000001B752000-memory.dmp

Filesize
2.9MB

Download
memory/2240-10-0x000007FEF6700000-0x000007FEF709D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-4-0x000007FEF69BE000-0x000007FEF69BF000-memory.dmp

Filesize
4KB

Download
memory/2240-8-0x000007FEF6700000-0x000007FEF709D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-6-0x0000000002AB0000-0x0000000002AB8000-memory.dmp

Filesize
32KB

Download
memory/2240-7-0x000007FEF6700000-0x000007FEF709D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing