95ad654302eff2de80fb7e4013540d85b39c62237db82b8164e2de24460348ae

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LTSC-Add-MicrosoftStore-master/Microsoft.VCLibs.140.00_14.0.26706.0_x86__8wekyb3d8bbwe.appx
Size 682KB
Sample240822-kfrfvsxckb
SHA256 1ab8e7cfa6e39fde3c6a8f60b183b0004fbff29f859d9214c7d5315533782a26
MD5 2480d5f73f701e5b7313d19b0cb1aaae
SHA1 186d7294857231915e8374454789b75141e98d53
SHA512 ec002368134cb78b0de945d58710416ef6457d081c8a91ed27e2ef08b7d1aac326e248dcac42ce7a3fdbbe25fe9cf9f43b183f8676fe6390cdf6bb508c5a83b1
SSDEEP 12288:2vRHiIG+5O9tWaUM6Cwx5VLJWFJ4gV4/FrpuJ4LbzwvDYQq1t:YZ956MTnx57VpeKfwvDtq1t
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4824	powershell.exe
4824	powershell.exe
4824	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:AppsFolder\Get-Content : Cannot find path 'C:\AppxManifest.xml' because it does not exist. At line:1 char:867 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (C:\AppxManifest.xml:String) [Get-Content], ItemNotFoundException + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe' is denied. At line:1 char:867 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Program File...__8wekyb3d8bbwe:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.26706.0_x86__8wekyb3d8bbwe' is denied. At line:1 char:867 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Program File...__8wekyb3d8bbwe:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Microsoft.VCLibs.140.00_8wekyb3d8bbwe Microsoft.VCLibs.140.00_8wekyb3d8bbwe !
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_tmxwglux.sa1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tmxwglux.sa1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/4824-0-0x00007FFBEDFC3000-0x00007FFBEDFC5000-memory.dmp

Download

memory/4824-10-0x0000017F735F0000-0x0000017F73612000-memory.dmp

Download

memory/4824-11-0x00007FFBEDFC0000-0x00007FFBEEA81000-memory.dmp

Download

memory/4824-12-0x00007FFBEDFC0000-0x00007FFBEEA81000-memory.dmp

Download

memory/4824-13-0x00007FFBEDFC0000-0x00007FFBEEA81000-memory.dmp

Download

memory/4824-15-0x00007FFBEDFC0000-0x00007FFBEEA81000-memory.dmp

Download