Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01-12-2024 16:06

General

  • Target

    125b4582b7dd2221044fb257f580da57e4dc61b03a6c35e208fed973f71c28a1.exe

  • Size

    859KB

  • MD5

    47fd98348b7d314e4e9dae46e5f1e1a1

  • SHA1

    cafe48404707e61235bfbe6646d8072af4298e21

  • SHA256

    125b4582b7dd2221044fb257f580da57e4dc61b03a6c35e208fed973f71c28a1

  • SHA512

    8a1deda7d7e8e80d8b2e62ad0d9d4400b1d865ea322955e577fc439a8a0f1d6d3cb912397ecb6458941fd7fd566c1fdbdf4c4ed02c72234fa543bfcb45db845a

  • SSDEEP

    12288:l9/IyjazmRR+BZhOLlpJjdCPwwdw6ETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZzz:/A/KqZhOnJdyzp+alCJmvulW6Nd0vo

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\125b4582b7dd2221044fb257f580da57e4dc61b03a6c35e208fed973f71c28a1.exe
    "C:\Users\Admin\AppData\Local\Temp\125b4582b7dd2221044fb257f580da57e4dc61b03a6c35e208fed973f71c28a1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2132
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    8b511b03e769af93845bfee11bb2f396

    SHA1

    6dc6fdbf99f1af8d23fa8b579009ea99434d5d73

    SHA256

    d7740880229460f654375f0a73f518c3ec3d54595ea12fbc2e810a7e688ed566

    SHA512

    1b15442907315a4902b587b5daedc688f60c0989abdfd0b93db82a913ea218f06575841b34586b3684c47ff650c2d32e1559736f9c7c24ffcab23d57d80dfc00

  • memory/2132-9-0x0000000074541000-0x0000000074542000-memory.dmp

    Filesize

    4KB

  • memory/2132-10-0x0000000074540000-0x0000000074AEB000-memory.dmp

    Filesize

    5.7MB

  • memory/2132-13-0x0000000074540000-0x0000000074AEB000-memory.dmp

    Filesize

    5.7MB

  • memory/2132-12-0x0000000074540000-0x0000000074AEB000-memory.dmp

    Filesize

    5.7MB

  • memory/2132-11-0x0000000074540000-0x0000000074AEB000-memory.dmp

    Filesize

    5.7MB

  • memory/2132-19-0x0000000074540000-0x0000000074AEB000-memory.dmp

    Filesize

    5.7MB