Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 06:55

General

  • Target

    50048e6f2c92f251bfc87da636dbc73080669bf84b8c5737db5af7b4bd4c27acN.exe

  • Size

    1.6MB

  • MD5

    4b98ac287e67eae4030bbc0c01a7a300

  • SHA1

    f3faa45b998f0950b4718339e50ec09c6663079b

  • SHA256

    50048e6f2c92f251bfc87da636dbc73080669bf84b8c5737db5af7b4bd4c27ac

  • SHA512

    dbbbe9d57065f0acc4545758786cec67c10dc86e1f79c5ee26a2fe5b29fe427285ca0a158cc81523b261ca5ff2993bd22d01c524d2078183b169aa609a4b85fb

  • SSDEEP

    49152:DAodtaG9kS2U84B+FLan9k5TRM9zleVjPSf:h/B1aS

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50048e6f2c92f251bfc87da636dbc73080669bf84b8c5737db5af7b4bd4c27acN.exe
    "C:\Users\Admin\AppData\Local\Temp\50048e6f2c92f251bfc87da636dbc73080669bf84b8c5737db5af7b4bd4c27acN.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1636
    • C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      2⤵
        PID:784
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
        2⤵
          PID:2800
        • C:\Windows\System32\calc.exe
          "C:\Windows\System32\calc.exe"
          2⤵
            PID:2796
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
            2⤵
              PID:3044
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              2⤵
                PID:2720
              • C:\Windows\regedit.exe
                "C:\Windows\regedit.exe"
                2⤵
                • Runs regedit.exe
                PID:2712
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                2⤵
                  PID:2832
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe"
                  2⤵
                    PID:2700
                  • C:\Windows\System32\svchost.exe
                    "C:\Windows\System32\svchost.exe"
                    2⤵
                      PID:2860
                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2168

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1636-4-0x000007FEF5C8E000-0x000007FEF5C8F000-memory.dmp

                    Filesize

                    4KB

                  • memory/1636-7-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/1636-6-0x0000000001D20000-0x0000000001D28000-memory.dmp

                    Filesize

                    32KB

                  • memory/1636-5-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

                    Filesize

                    2.9MB

                  • memory/1636-8-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/1636-9-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/1636-10-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/1636-11-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/1636-12-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/2168-13-0x0000000000400000-0x0000000000447000-memory.dmp

                    Filesize

                    284KB

                  • memory/2168-14-0x0000000000400000-0x0000000000447000-memory.dmp

                    Filesize

                    284KB

                  • memory/2168-15-0x0000000000960000-0x0000000000C63000-memory.dmp

                    Filesize

                    3.0MB

                  • memory/2168-16-0x0000000000400000-0x0000000000447000-memory.dmp

                    Filesize

                    284KB