671d1bd3c3281935daaf31d5f9265b019509371442c2e8eba4f3626dec2418fe

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
STIMenu/STI Launcher.lnk
Size 3KB
Sample240813-xt4dsswbnk
SHA256 a94dd53a0cae120d9f519d65d0f4d3e3f488b73276ad2d193987cf68c588ad6c
MD5 66eeece442e5eea4ae9c41e449732bce
SHA1 ab53def6a5b44debcc9dbcf397c354f8470342a7
SHA512 1275345ea5ea7e6659384879d6aa20487e97dd707d771b6f267594db9685c1d94f52bce4f95d6cc0471bdf88d06561667d806797ff95c356a1e2710ecf6124c0
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1260	powershell.exe
6	1260	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1488	powershell.exe
3044	powershell.exe
2620	powershell.exe
2640	powershell.exe
1680	powershell.exe
1668	powershell.exe
1260	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 11 IoCs

evasion

pid	Process
832	timeout.exe
2404	timeout.exe
1228	timeout.exe
2168	timeout.exe
1608	timeout.exe
2456	timeout.exe
696	timeout.exe
1812	timeout.exe
1312	timeout.exe
2416	timeout.exe
2116	timeout.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2640	powershell.exe
1680	powershell.exe
1668	powershell.exe
1488	powershell.exe
3044	powershell.exe
2620	powershell.exe
1260	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2760	2564	cmd.exe	31
PID 2564 wrote to memory of 2760	2564	cmd.exe	31
PID 2564 wrote to memory of 2760	2564	cmd.exe	31
PID 2760 wrote to memory of 3012	2760	cmd.exe	32
PID 2760 wrote to memory of 3012	2760	cmd.exe	32
PID 2760 wrote to memory of 3012	2760	cmd.exe	32
PID 2760 wrote to memory of 2640	2760	cmd.exe	33
PID 2760 wrote to memory of 2640	2760	cmd.exe	33
PID 2760 wrote to memory of 2640	2760	cmd.exe	33
PID 2760 wrote to memory of 1680	2760	cmd.exe	34
PID 2760 wrote to memory of 1680	2760	cmd.exe	34
PID 2760 wrote to memory of 1680	2760	cmd.exe	34
PID 2760 wrote to memory of 1668	2760	cmd.exe	35
PID 2760 wrote to memory of 1668	2760	cmd.exe	35
PID 2760 wrote to memory of 1668	2760	cmd.exe	35
PID 2760 wrote to memory of 1488	2760	cmd.exe	36
PID 2760 wrote to memory of 1488	2760	cmd.exe	36
PID 2760 wrote to memory of 1488	2760	cmd.exe	36
PID 2760 wrote to memory of 3044	2760	cmd.exe	37
PID 2760 wrote to memory of 3044	2760	cmd.exe	37
PID 2760 wrote to memory of 3044	2760	cmd.exe	37
PID 2760 wrote to memory of 2620	2760	cmd.exe	38
PID 2760 wrote to memory of 2620	2760	cmd.exe	38
PID 2760 wrote to memory of 2620	2760	cmd.exe	38
PID 2760 wrote to memory of 832	2760	cmd.exe	40
PID 2760 wrote to memory of 832	2760	cmd.exe	40
PID 2760 wrote to memory of 832	2760	cmd.exe	40
PID 2760 wrote to memory of 1260	2760	cmd.exe	41
PID 2760 wrote to memory of 1260	2760	cmd.exe	41
PID 2760 wrote to memory of 1260	2760	cmd.exe	41
PID 2760 wrote to memory of 696	2760	cmd.exe	43
PID 2760 wrote to memory of 696	2760	cmd.exe	43
PID 2760 wrote to memory of 696	2760	cmd.exe	43
PID 2760 wrote to memory of 1812	2760	cmd.exe	44
PID 2760 wrote to memory of 1812	2760	cmd.exe	44
PID 2760 wrote to memory of 1812	2760	cmd.exe	44
PID 2760 wrote to memory of 2404	2760	cmd.exe	45
PID 2760 wrote to memory of 2404	2760	cmd.exe	45
PID 2760 wrote to memory of 2404	2760	cmd.exe	45
PID 2760 wrote to memory of 1312	2760	cmd.exe	46
PID 2760 wrote to memory of 1312	2760	cmd.exe	46
PID 2760 wrote to memory of 1312	2760	cmd.exe	46
PID 2760 wrote to memory of 1228	2760	cmd.exe	47
PID 2760 wrote to memory of 1228	2760	cmd.exe	47
PID 2760 wrote to memory of 1228	2760	cmd.exe	47
PID 2760 wrote to memory of 2416	2760	cmd.exe	48
PID 2760 wrote to memory of 2416	2760	cmd.exe	48
PID 2760 wrote to memory of 2416	2760	cmd.exe	48
PID 2760 wrote to memory of 2116	2760	cmd.exe	49
PID 2760 wrote to memory of 2116	2760	cmd.exe	49
PID 2760 wrote to memory of 2116	2760	cmd.exe	49
PID 2760 wrote to memory of 2168	2760	cmd.exe	50
PID 2760 wrote to memory of 2168	2760	cmd.exe	50
PID 2760 wrote to memory of 2168	2760	cmd.exe	50
PID 2760 wrote to memory of 1608	2760	cmd.exe	51
PID 2760 wrote to memory of 1608	2760	cmd.exe	51
PID 2760 wrote to memory of 1608	2760	cmd.exe	51
PID 2760 wrote to memory of 2456	2760	cmd.exe	52
PID 2760 wrote to memory of 2456	2760	cmd.exe	52
PID 2760 wrote to memory of 2456	2760	cmd.exe	52

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\STIMenu\STI Launcher.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\STIMenu\Main\Extra\RunMenu.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\system32\cacls.exe
    "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
    3⤵
    PID:3012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\AppData\Roaming\Temp
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Temp\fwky1wyq1u.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Appdata\Local\Temp
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Downloads
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Desktop
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Temp
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle hidden -executionpolicy bypass -File .\Updater.ps1
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:696
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1812
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:2404
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1312
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1228
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:2416
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:2116
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:2168
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1608
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 d7a71eb64744fb3dea6946ce0b3e48c0ac7f3a1cdfc9e84873f2852004289c56
MD5 6d0e88256ce72c404266242f8a63948b
SHA1 d1bde0a1ac4b2f6369bb2b3af4f458c1c9b3810e
SHA512 2ebe3cc1e05a9ca44fddc71298a8c5cd2b69bd565c3449ab552f4786b301b555e463ba0217117e9aaf760fd38687a0eafc7079b71db8cce6be426496cf251e4d
SSDEEP 96:QUOnGC5M8WnqvsqvJCwoPlUOnGC5M8WnqvsEHyqvJCwordxKS0QHSR75jXlUVqT:wnHaUo3nHaAHnorLcjR75jv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1680-71-0x000000001B540000-0x000000001B822000-memory.dmp

Download

memory/1680-72-0x0000000001F70000-0x0000000001F78000-memory.dmp

Download

memory/2640-64-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Download

memory/2640-65-0x0000000002240000-0x0000000002248000-memory.dmp

Download