Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2024, 13:36

General

  • Target

    FluxTweakingTool.bat

  • Size

    44KB

  • MD5

    bf13135aeb51a50a0400db422fd7daa9

  • SHA1

    5ef6d801e7b97128fcce8dcafa8aeb81d64fc2db

  • SHA256

    5f02f68d5187cc53317a1139dfa2a5824e5eee2e7517a3b58cff82062086bd8f

  • SHA512

    6367b7ec2fbae156c6061b3c2fe2781b60011f59b06aec3f465da15b57d0f5c1ad68e332e2c9572446b348232ad252ef9096219f1037fe92a31411497fc467e5

  • SSDEEP

    384:mut4C7QIEkKx3mmoYHYWLNmGr1tslFvnnWNyMnerjo+Cozvy4UD+jjGs2pt3JNur:mut4C7QIXmoYHYWLNmGNPxO

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\FluxTweakingTool.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      POWERSHELL "Set-ExecutionPolicy -ExecutionPolicy Unrestricted"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      POWERSHELL "ForEach($v in (Get-Command -Name \"Set-ProcessMitigation\").Parameters[\"Disable\"].Attributes.ValidValues){Set-ProcessMitigation -System -Disable $v.ToString() -ErrorAction SilentlyContinue}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      POWERSHELL Disable-MMAgent -MemoryCompression -ApplicationPreLaunch -ErrorAction SilentlyContinue
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
    • C:\Windows\system32\chcp.com
      chcp 65001
      2⤵
        PID:2584
      • C:\Windows\system32\mode.com
        mode con cols=80 lines=25
        2⤵
          PID:2616

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

              Filesize

              7KB

              MD5

              54e1df083bf5ef2f93177cfd7252179f

              SHA1

              006f32065a6689fdde94dceec2c942cb3df9865c

              SHA256

              3b609eb4b20367d5abfed0630c4a16f032ffb626f29b91e2becd68930cf9a050

              SHA512

              3ece9b348a36db8b0475c18664143191fd4ba588783f825aa3746cfc6ebdfdc7f9577b1947e07b45dd475e7b38cb3f80914300fe1c45e4d0bfd047ff7bca8003

            • memory/2692-4-0x000007FEF630E000-0x000007FEF630F000-memory.dmp

              Filesize

              4KB

            • memory/2692-5-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

              Filesize

              2.9MB

            • memory/2692-6-0x0000000001E70000-0x0000000001E78000-memory.dmp

              Filesize

              32KB

            • memory/2692-8-0x0000000002DBB000-0x0000000002E22000-memory.dmp

              Filesize

              412KB

            • memory/2692-7-0x0000000002DB4000-0x0000000002DB7000-memory.dmp

              Filesize

              12KB

            • memory/2692-9-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

              Filesize

              9.6MB

            • memory/2784-15-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

              Filesize

              2.9MB

            • memory/2784-16-0x0000000001E10000-0x0000000001E18000-memory.dmp

              Filesize

              32KB