Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-10-2024 01:36
Static task
static1
Behavioral task
behavioral1
Sample
9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Melibiose.ps1
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Melibiose.ps1
Resource
win10v2004-20241007-en
General
-
Target
9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe
-
Size
868KB
-
MD5
c676d09741d75516a52593da851f8e81
-
SHA1
d240a1271f4a3a0380a550d7c34bbfc5e2f3212b
-
SHA256
9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc
-
SHA512
1f032edb87bf2f7333e74e2ff997c07731974163d6e961261aee24b5e1ee6b00e3fe451c77e2983b509959d8ca86979b29796de133b1832c463894f46bae5b80
-
SSDEEP
12288:l9Aw7LtaVYyyQiZ5Q20zMETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZz0ma2:/AmtaVYyyQijQ9g+alCJmvulW6Nd0v2
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 2772 powershell.exe 2240 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exepowershell.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 2240 powershell.exe 2772 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2240 powershell.exe Token: SeDebugPrivilege 2772 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exedescription pid process target process PID 3028 wrote to memory of 2240 3028 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe powershell.exe PID 3028 wrote to memory of 2240 3028 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe powershell.exe PID 3028 wrote to memory of 2240 3028 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe powershell.exe PID 3028 wrote to memory of 2240 3028 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe powershell.exe PID 3028 wrote to memory of 2772 3028 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe powershell.exe PID 3028 wrote to memory of 2772 3028 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe powershell.exe PID 3028 wrote to memory of 2772 3028 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe powershell.exe PID 3028 wrote to memory of 2772 3028 9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe"C:\Users\Admin\AppData\Local\Temp\9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Bittermandler=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Melibiose.Spa';$Datarepraesentation=$Bittermandler.SubString(54249,3);.$Datarepraesentation($Bittermandler)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Bittermandler=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Melibiose.Spa';$Datarepraesentation=$Bittermandler.SubString(54249,3);.$Datarepraesentation($Bittermandler)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5a6c3b720621051d76ffee456f664d473
SHA175c606233d92b6c79096d57c30a554c96a5b46fa
SHA256950b0621c67711120b8d3092ce4ef4cb1a99fe46464422a6f80a0c4c19435b8a
SHA51253e1eeb15887dc1bd709e8c3107db64ba1eee7a9eab4eecac4b4216443473fd7e3dbc1751180ea4fe911d0c7a6ef8966d1f3c78635f7a18d6b0016387bfae3a3