Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10-12-2024 03:06
Static task
static1
Behavioral task
behavioral1
Sample
855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe
Resource
win10v2004-20241007-en
General
-
Target
855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe
-
Size
1.0MB
-
MD5
ca3706dd6a93c5928ee3252054a7ec74
-
SHA1
402c4c006bf0e4d7afec7687f6033dccf11c6aa1
-
SHA256
855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e
-
SHA512
e83540a28bb8b6a014d40cc66842b0c045e712f894df967ade6939461120f61a9580c85c3915aa8103c4faa40077a26d9e9dbecfc7086a9529105c2e409b048d
-
SSDEEP
24576:Ij+EfvosO3Hx7JwmNG3Ap137dboaPjyMi76Kb0:Y+MvpoOt3IRM+i76f
Malware Config
Signatures
-
pid Process 2260 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2260 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2260 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2260 2524 855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe 29 PID 2524 wrote to memory of 2260 2524 855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe 29 PID 2524 wrote to memory of 2260 2524 855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe 29 PID 2524 wrote to memory of 2260 2524 855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe"C:\Users\Admin\AppData\Local\Temp\855acbd89e8548eaaa06d25d0c767f6a1d550afd766c145d04a3fbc2eae6b80e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Lucid=Get-Content -Raw 'C:\Users\Admin\AppData\Roaming\Polysulfonate\sangersken\Thiostannous.Acu';$Astelic=$Lucid.SubString(38084,3);.$Astelic($Lucid)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260
-