26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6

Resubmissions

27/08/2024, 01:28

240827-bvntvaxfpp10

27/08/2024, 01:00

240827-bc5pmswgpr10

26/08/2024, 05:53

240826-glgxtszdpp10

22/08/2024, 07:34

240822-jedb6svfpe10

Analysis

max time kernel
327s
max time network
328s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2024, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe
Size 3.3MB
Sample240827-bvntvaxfpp
SHA256 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6
MD5 e52f30961dfc54e980d1aa1ae0d16145
SHA1 6e22251748e5cd0a9ea745a8dce14352b619ec99
SHA512 b6bbd178a529d355fc00c7ab769d3b573f778d00b05952a1700cbfd161d4c809886a9073b7de37d3210fe6f5e0823be731bb53021a8fce199d26d1f3a5e8595b
SSDEEP 49152:vX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q9:vlRsZ47/QXoHUOfAoj1x69
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4992	powershell.exe
1396	powershell.exe
4376	powershell.exe
2112	powershell.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133691957217532068"	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1396	powershell.exe
1396	powershell.exe
4376	powershell.exe
4376	powershell.exe
2112	powershell.exe
2112	powershell.exe
2112	powershell.exe
4992	powershell.exe
4992	powershell.exe
4992	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4036	wmic.exe
Token: SeSecurityPrivilege	4036	wmic.exe
Token: SeTakeOwnershipPrivilege	4036	wmic.exe
Token: SeLoadDriverPrivilege	4036	wmic.exe
Token: SeSystemProfilePrivilege	4036	wmic.exe
Token: SeSystemtimePrivilege	4036	wmic.exe
Token: SeProfSingleProcessPrivilege	4036	wmic.exe
Token: SeIncBasePriorityPrivilege	4036	wmic.exe
Token: SeCreatePagefilePrivilege	4036	wmic.exe
Token: SeBackupPrivilege	4036	wmic.exe
Token: SeRestorePrivilege	4036	wmic.exe
Token: SeShutdownPrivilege	4036	wmic.exe
Token: SeDebugPrivilege	4036	wmic.exe
Token: SeSystemEnvironmentPrivilege	4036	wmic.exe
Token: SeRemoteShutdownPrivilege	4036	wmic.exe
Token: SeUndockPrivilege	4036	wmic.exe
Token: SeManageVolumePrivilege	4036	wmic.exe
Token: 33	4036	wmic.exe
Token: 34	4036	wmic.exe
Token: 35	4036	wmic.exe
Token: 36	4036	wmic.exe
Token: SeIncreaseQuotaPrivilege	4036	wmic.exe
Token: SeSecurityPrivilege	4036	wmic.exe
Token: SeTakeOwnershipPrivilege	4036	wmic.exe
Token: SeLoadDriverPrivilege	4036	wmic.exe
Token: SeSystemProfilePrivilege	4036	wmic.exe
Token: SeSystemtimePrivilege	4036	wmic.exe
Token: SeProfSingleProcessPrivilege	4036	wmic.exe
Token: SeIncBasePriorityPrivilege	4036	wmic.exe
Token: SeCreatePagefilePrivilege	4036	wmic.exe
Token: SeBackupPrivilege	4036	wmic.exe
Token: SeRestorePrivilege	4036	wmic.exe
Token: SeShutdownPrivilege	4036	wmic.exe
Token: SeDebugPrivilege	4036	wmic.exe
Token: SeSystemEnvironmentPrivilege	4036	wmic.exe
Token: SeRemoteShutdownPrivilege	4036	wmic.exe
Token: SeUndockPrivilege	4036	wmic.exe
Token: SeManageVolumePrivilege	4036	wmic.exe
Token: 33	4036	wmic.exe
Token: 34	4036	wmic.exe
Token: 35	4036	wmic.exe
Token: 36	4036	wmic.exe
Token: SeIncreaseQuotaPrivilege	4332	wmic.exe
Token: SeSecurityPrivilege	4332	wmic.exe
Token: SeTakeOwnershipPrivilege	4332	wmic.exe
Token: SeLoadDriverPrivilege	4332	wmic.exe
Token: SeSystemProfilePrivilege	4332	wmic.exe
Token: SeSystemtimePrivilege	4332	wmic.exe
Token: SeProfSingleProcessPrivilege	4332	wmic.exe
Token: SeIncBasePriorityPrivilege	4332	wmic.exe
Token: SeCreatePagefilePrivilege	4332	wmic.exe
Token: SeBackupPrivilege	4332	wmic.exe
Token: SeRestorePrivilege	4332	wmic.exe
Token: SeShutdownPrivilege	4332	wmic.exe
Token: SeDebugPrivilege	4332	wmic.exe
Token: SeSystemEnvironmentPrivilege	4332	wmic.exe
Token: SeRemoteShutdownPrivilege	4332	wmic.exe
Token: SeUndockPrivilege	4332	wmic.exe
Token: SeManageVolumePrivilege	4332	wmic.exe
Token: 33	4332	wmic.exe
Token: 34	4332	wmic.exe
Token: 35	4332	wmic.exe
Token: 36	4332	wmic.exe
Token: SeIncreaseQuotaPrivilege	4332	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4036	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	92
PID 4064 wrote to memory of 4036	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	92
PID 4064 wrote to memory of 4332	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	95
PID 4064 wrote to memory of 4332	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	95
PID 4064 wrote to memory of 2716	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	97
PID 4064 wrote to memory of 2716	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	97
PID 4064 wrote to memory of 4824	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	100
PID 4064 wrote to memory of 4824	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	100
PID 4064 wrote to memory of 4484	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	102
PID 4064 wrote to memory of 4484	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	102
PID 4064 wrote to memory of 4372	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	104
PID 4064 wrote to memory of 4372	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	104
PID 4064 wrote to memory of 1396	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	106
PID 4064 wrote to memory of 1396	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	106
PID 4064 wrote to memory of 4376	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	109
PID 4064 wrote to memory of 4376	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	109
PID 4064 wrote to memory of 2112	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	113
PID 4064 wrote to memory of 2112	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	113
PID 4064 wrote to memory of 4992	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	116
PID 4064 wrote to memory of 4992	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	116
PID 4064 wrote to memory of 1780	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	118
PID 4064 wrote to memory of 1780	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	118
PID 1780 wrote to memory of 3740	1780	cmd.exe	120
PID 1780 wrote to memory of 3740	1780	cmd.exe	120
PID 4064 wrote to memory of 4372	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	121
PID 4064 wrote to memory of 4372	4064	26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe	121
PID 4372 wrote to memory of 1064	4372	cmd.exe	123
PID 4372 wrote to memory of 1064	4372	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe
C:\Users\Admin\AppData\Local\Temp\26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe run
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\System32\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4332
- C:\Windows\System32\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  PID:2716
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  PID:4824
- C:\Windows\System32\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  PID:4484
- C:\Windows\System32\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:3740
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F: -Type recoverypassword
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F: -Type recoverypassword
    3⤵
    PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723
MD5 06d16fea6ab505097d16fcaa32949d47
SHA1 0c1c719831fa41cd102d0d72d61c0f46ec5b8de8
SHA512 03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 5485280090bd71cdbbb07f4fce6efec651065fa257aa14160327632dee1bfeca
MD5 f2329759d5195d9bc1956de05b112aab
SHA1 4c0cc1b12a0f7b2e5f89b248c354f36acb3631f3
SHA512 2c5b4db3a88555f2059252d954b3d49f7dfd1ce8fa62484859a6507899382594611bdddbafbf77134b5270c7ad45990f44f1528654e8b0aace843f7edf67e6b5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 1a9776dd5505015b366fd5362e9bed90cf080427e252ae5a6d094d99aa4a1e87
MD5 772e51df27837100fa68cbece103969e
SHA1 b7dae8a3e9e72ea75b73d8e0b3dabd80f113a7b9
SHA512 4946aa50cee49ca077bf242f98cb5d01374a217908510fef1b8d0a163262c5abec4eae80021617853ee5698c117e5c4ee4a1861642e324147b5a7db3d164d4f9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 3050531d52dc766978528c80c65cecd3e3110f2a0e22951bb337200b106aaf86
MD5 87ae4c54e1343569abb97bf51c29a9f6
SHA1 6dc4a02717aa9a4f4a3747566fe1a8372a0ed50d
SHA512 cdc244399026256c26d9bb8551771eeea549446f6a815e0340b2a8e316ee5536e5712d63bd4867d22188b4623b5f90944bf2c9568b262d3f282ef823f11d7956
MD5 SHA1 SHA512

Submit Download

26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.db.tmp

Path C:\Users\Admin\AppData\Local\Temp\26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.db.tmp
Size 151KB
SHA256 d5859360688ce5a92f3e4408786c268982eef84b8f17cdd23fdb457af969e7c5
MD5 78c1a1af65a4c53c284b8d1707170867
SHA1 3aca5259347c99fb813920dfd61ff05a6713d9f6
SHA512 92d52ba4c9afe28af73b091533b7a789a9742835d709498aea9afaa89fc1d1eedafed51e1b437cc5b679e2be2be576e985efb43ba0db7fa111cbecdcb29d2748
SSDEEP 3072:Jij9+IIQh4LER+bxOFR+DLkcwcpG55UJBM9W1hQs1mVI:O9+dQh4gek86/UJ28+skVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_okoeo2wx.mgy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_okoeo2wx.mgy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1396-33-0x0000027E69B60000-0x0000027E69B82000-memory.dmp

Download

memory/1396-34-0x0000027E6A6D0000-0x0000027E6A714000-memory.dmp

Download

memory/1396-35-0x0000027E6AB10000-0x0000027E6AB86000-memory.dmp

Download

memory/4992-82-0x000002357AB20000-0x000002357AB2A000-memory.dmp

Download

memory/4992-83-0x000002357ABC0000-0x000002357ABEA000-memory.dmp

Download

memory/4992-84-0x000002357ABC0000-0x000002357ABE4000-memory.dmp

Download