Resubmissions

02/09/2024, 21:14 UTC

240902-z3rgpsxcnm 9

02/09/2024, 21:08 UTC

240902-zyvnkaxbqj 9

02/09/2024, 20:57 UTC

240902-zrx54sxapk 9

02/09/2024, 20:52 UTC

240902-znsffsxajm 9

Analysis

  • max time kernel
    426s
  • max time network
    1153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/09/2024, 21:14 UTC

General

  • Target

    locales/uk.ps1

  • Size

    688KB

  • MD5

    e4c4e3700469704b936460ca1a90fcc0

  • SHA1

    e809990fc07a1d39fe623046382699e648e343c0

  • SHA256

    29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb

  • SHA512

    68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

  • SSDEEP

    12288:FkzOqMnty/KiZswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:muGN35EEK

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5064
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2948

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    self.events.data.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    self.events.data.microsoft.com
    IN A
    Response
    self.events.data.microsoft.com
    IN CNAME
    self-events-data.trafficmanager.net
    self-events-data.trafficmanager.net
    IN CNAME
    onedscolprdcus05.centralus.cloudapp.azure.com
    onedscolprdcus05.centralus.cloudapp.azure.com
    IN A
    20.44.10.123
  • flag-us
    DNS
    123.10.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    123.10.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ctldl.windowsupdate.com
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    ctldl.windowsupdate.com.delivery.microsoft.com
    ctldl.windowsupdate.com.delivery.microsoft.com
    IN CNAME
    wu-b-net.trafficmanager.net
    wu-b-net.trafficmanager.net
    IN CNAME
    download.windowsupdate.com.edgesuite.net
    download.windowsupdate.com.edgesuite.net
    IN CNAME
    a767.dspw65.akamai.net
    a767.dspw65.akamai.net
    IN A
    2.22.144.81
    a767.dspw65.akamai.net
    IN A
    2.22.144.73
  • flag-us
    DNS
    ocsp.digicert.com
    Remote address:
    8.8.8.8:53
    Request
    ocsp.digicert.com
    IN A
    Response
    ocsp.digicert.com
    IN CNAME
    ocsp.edge.digicert.com
    ocsp.edge.digicert.com
    IN CNAME
    fp2e7a.wpc.2be4.phicdn.net
    fp2e7a.wpc.2be4.phicdn.net
    IN CNAME
    fp2e7a.wpc.phicdn.net
    fp2e7a.wpc.phicdn.net
    IN A
    192.229.221.95
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • flag-us
    DNS
    ctldl.windowsupdate.com
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    ctldl.windowsupdate.com.delivery.microsoft.com
    ctldl.windowsupdate.com.delivery.microsoft.com
    IN CNAME
    wu-b-net.trafficmanager.net
    wu-b-net.trafficmanager.net
    IN CNAME
    download.windowsupdate.com.edgesuite.net
    download.windowsupdate.com.edgesuite.net
    IN CNAME
    a767.dspw65.akamai.net
    a767.dspw65.akamai.net
    IN A
    2.22.144.73
    a767.dspw65.akamai.net
    IN A
    2.22.144.81
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
No results found
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    626 B
    1.6kB
    9
    9

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    43.229.111.52.in-addr.arpa

    DNS Request

    self.events.data.microsoft.com

    DNS Response

    20.44.10.123

    DNS Request

    123.10.44.20.in-addr.arpa

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    2.22.144.81
    2.22.144.73

    DNS Request

    ocsp.digicert.com

    DNS Response

    192.229.221.95

    DNS Request

    81.144.22.2.in-addr.arpa

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    2.22.144.73
    2.22.144.81

    DNS Request

    73.144.22.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hzy5juwz.1tq.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/5064-0-0x00007FFFE8D23000-0x00007FFFE8D25000-memory.dmp

    Filesize

    8KB

  • memory/5064-9-0x000001E62D290000-0x000001E62D2B2000-memory.dmp

    Filesize

    136KB

  • memory/5064-10-0x00007FFFE8D20000-0x00007FFFE97E2000-memory.dmp

    Filesize

    10.8MB

  • memory/5064-11-0x00007FFFE8D20000-0x00007FFFE97E2000-memory.dmp

    Filesize

    10.8MB

  • memory/5064-12-0x00007FFFE8D20000-0x00007FFFE97E2000-memory.dmp

    Filesize

    10.8MB

  • memory/5064-15-0x00007FFFE8D20000-0x00007FFFE97E2000-memory.dmp

    Filesize

    10.8MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.