Analysis

  • max time kernel
    97s
  • max time network
    143s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    10/11/2024, 21:55

General

  • Target

    pgxmuwgx.exe

  • Size

    3.3MB

  • MD5

    2a548b249ee8db152f03a9b734eec566

  • SHA1

    eeb6e62c5e3a3bd390773786f0ca33ee3f0dbccb

  • SHA256

    467067b7b752259afab91d03a8e163b5022341d359fe0d31cfe0c28af4ccec38

  • SHA512

    0d8b122c8a389ee13dbd5e7600f70e5fa3a497fa9922ea627ffc77bc7517d57930ccbe3c9d89b91c07961244b890035b67380de06dedc1d257cd51ed7194a9e8

  • SSDEEP

    98304:OK3G1lOQFDprOsrLjJwyHCdMHLbB50dF7+OXQ:OSGb9DJj/HWIHX0dc

Score
5/10

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pgxmuwgx.exe
    "C:\Users\Admin\AppData\Local\Temp\pgxmuwgx.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c color 0a && mode con: cols=90 lines=26
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Windows\system32\mode.com
        mode con: cols=90 lines=26
        3⤵
          PID:4432
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Get-AppPackage -Name Microsoft.MinecraftUWP | Select-Object -ExpandProperty Version"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4232
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Get-AppPackage -Name Microsoft.MinecraftUWP | Select-Object -ExpandProperty Architecture"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3396

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            3KB

            MD5

            4e50615fbb2682d496773c1e3985a98e

            SHA1

            67413638787fdae9a8fb43c128811faf7dabc8ce

            SHA256

            a13af49afd14efc8d114fbfd0ae7311482cd7af29c3d0cfc2b18be76c872bf94

            SHA512

            852df909000e14c6e1c35bbff1602ddcf04756e17eee788cd1c78131e18e3b0f7034aa5b29e3c39957d667719956b3876fd001269e4fb9672a8db2e89ae8c79b

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            1a3101f3c4c89b36ec469cee45b28487

            SHA1

            c188454a1dcadcf103d53b4275f509165abd2088

            SHA256

            62b50d6eb485d2b12f24bd64578560fbfc3b6fc97434682573fe3da44cb99f83

            SHA512

            c44724cc276f3ad139857c40b7edf19e01eb0d1b2d66f1d8f74449ed3e2503fb1fff65984cba85b8f921f8bf96928cc7f3d194230720412eb731faff991ec959

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ue23f4p1.y5o.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/4192-0-0x00007FF6E2C70000-0x00007FF6E42F3C27-memory.dmp

            Filesize

            22.5MB

          • memory/4192-35-0x00007FF6E2C70000-0x00007FF6E42F3C27-memory.dmp

            Filesize

            22.5MB

          • memory/4192-33-0x00007FF6E2C70000-0x00007FF6E42F3C27-memory.dmp

            Filesize

            22.5MB

          • memory/4232-14-0x00007FF8E6F40000-0x00007FF8E7A02000-memory.dmp

            Filesize

            10.8MB

          • memory/4232-15-0x00000152CFEA0000-0x00000152CFEB6000-memory.dmp

            Filesize

            88KB

          • memory/4232-16-0x00000152CFE90000-0x00000152CFE9A000-memory.dmp

            Filesize

            40KB

          • memory/4232-17-0x00000152D0090000-0x00000152D00B6000-memory.dmp

            Filesize

            152KB

          • memory/4232-20-0x00007FF8E6F40000-0x00007FF8E7A02000-memory.dmp

            Filesize

            10.8MB

          • memory/4232-13-0x00007FF8E6F40000-0x00007FF8E7A02000-memory.dmp

            Filesize

            10.8MB

          • memory/4232-12-0x00000152CFC20000-0x00000152CFC42000-memory.dmp

            Filesize

            136KB

          • memory/4232-11-0x00007FF8E6F40000-0x00007FF8E7A02000-memory.dmp

            Filesize

            10.8MB

          • memory/4232-1-0x00007FF8E6F43000-0x00007FF8E6F45000-memory.dmp

            Filesize

            8KB