Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 02:03
Static task
static1
Behavioral task
behavioral1
Sample
Offer-7839373637-8839373-Quote8992832.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Offer-7839373637-8839373-Quote8992832.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Saganashes.ps1
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Saganashes.ps1
Resource
win10v2004-20241007-en
General
-
Target
Saganashes.ps1
-
Size
51KB
-
MD5
86971efe48eae4401b734e86152c12aa
-
SHA1
93376b7df5fa9f5d363e263dd898b86e42e40ec0
-
SHA256
8e626d6dc0bb24ed272eaec732b70f81e306c38eba28df9e96ce78d61a75e455
-
SHA512
a04489dfa81e2fe20f1a8f07c562ed4a05f85b74d5745d6cb712252a46f997a7de6c9f11c3fa902c7c7b03f6ff8596e89e064c251b6a348dfb0d3b7ff6a02455
-
SSDEEP
768:AN4iitGvtxOdn/KpRVkmzfjoAPPSQJorIsqd1d4FdJF9wBYExO4u5lwSnuzC:C6o7kn/KdHdf2rtC1d42BYExOT5lwQ
Malware Config
Signatures
-
pid Process 2376 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2376 powershell.exe 2376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2376 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2760 2376 powershell.exe 30 PID 2376 wrote to memory of 2760 2376 powershell.exe 30 PID 2376 wrote to memory of 2760 2376 powershell.exe 30
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Saganashes.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2376" "912"2⤵PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bfcd8c598d59c2aa100027e4984def63
SHA19b6ea396825711b0668d70919392abaae4b96f32
SHA256f596a49a4855e4440f371c7c6495354760470708e5c9511a306679d89820bef5
SHA5129cb43e27f427869bd71863970db89a54c4766e3ab11a72e4128bc51c997df5639a420daa44a931fc8971589fef8bd117bcd932e3dada587f87eaaaedee17f84a