94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a

General

Target
94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe
Size 1.5MB
Sample260723-qcaa3azbmd
SHA256 94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a
MD5 a2df5576215f117fab93456b18968890
SHA1 c344f903af49afc3766ee0de6419bc587ffeea1f
SHA512 2ad3b1921f9a29525bba5d3a48c22a4b803b373ff3940222221e0d6f65f029b517f96f9f9ac309767dcbc65b1d99961f6bf8a929d8a06537c7c8f8d5e89e0270
SSDEEP 12288:y4gjskV8JPiME/lspl2aQMoMOAPqQBnEC+/12SpOoqiXhyqbvTqMXkEOAxS5:ylsTE/lspJ+/1Aocqb37JxS
TLSH
T1FE75A54BEBB650D1F5BAC139D552223AFC723CA1873897D792856A0A1B30FE4AD7D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6060	cmd.exe
6076	cmd.exe
5088	cmd.exe
5264	cmd.exe
3032	cmd.exe
5756	cmd.exe
5928	cmd.exe
5892	cmd.exe
5724	cmd.exe
6020	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5816	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	powershell.exe
2084	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 5892	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	87
PID 4004 wrote to memory of 6076	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	88
PID 4004 wrote to memory of 6060	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	89
PID 4004 wrote to memory of 5088	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	90
PID 4004 wrote to memory of 5264	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	91
PID 4004 wrote to memory of 3032	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	92
PID 3032 wrote to memory of 2084	3032	cmd.exe	93
PID 3032 wrote to memory of 1664	3032	cmd.exe	94
PID 3032 wrote to memory of 3456	3032	cmd.exe	95
PID 3032 wrote to memory of 5052	3032	cmd.exe	96
PID 4004 wrote to memory of 5756	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	97
PID 4004 wrote to memory of 5724	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	98
PID 5724 wrote to memory of 5816	5724	cmd.exe	99
PID 4004 wrote to memory of 6020	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	100
PID 4004 wrote to memory of 5928	4004	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	101

C:\Users\Admin\AppData\Local\Temp\94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe
"C:\Users\Admin\AppData\Local\Temp\94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title FreeDownloader
  2⤵
  - Executes a command shell one-liner
  PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir Downloads
  2⤵
  - Executes a command shell one-liner
  PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir config
  2⤵
  - Executes a command shell one-liner
  PID:6060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir cookies
  2⤵
  - Executes a command shell one-liner
  PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir temp
  2⤵
  - Executes a command shell one-liner
  PID:5264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell [guid]::NewGuid() | find /v "Guid" | find /v "--" | find "-" > config\uuid
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell [guid]::NewGuid()
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\system32\find.exe
    find /v "Guid"
    3⤵
    PID:1664
- - C:\Windows\system32\find.exe
    find /v "--"
    3⤵
    PID:3456
- - C:\Windows\system32\find.exe
    find "-"
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0B
  2⤵
  - Executes a command shell one-liner
  PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c TIMEOUT /T 2 > nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\system32\timeout.exe
    TIMEOUT /T 2
    3⤵
    - Delays execution with timeout.exe
    PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0B
  2⤵
  - Executes a command shell one-liner
  PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ztc0ld2l.23b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ztc0ld2l.23b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uuid

Path C:\Users\Admin\AppData\Local\Temp\config\uuid
Size 38B
SHA256 63c5422637fd8e64b1b8c506b87c166b14a2a709157a82b93336ee452a687bd3
MD5 4c0c65dc3bbc756524626398b4b06b6a
SHA1 2aee461f0eabd8095d862fd3ffdf0d729e075f2c
SHA512 815a132e16a55a57a6dca696435ab6e1ffb7dad840f41724db10bd76d9e0a5bec96ee492e97ec79c4fd77ecc692e4a2b7f5dea7e947a959debd1752862e6e0ec
MD5 SHA1 SHA512

Submit Download

memory/2084-1-0x00000203F9E60000-0x00000203F9E70000-memory.dmp

Download

memory/2084-2-0x00000203F9E60000-0x00000203F9E70000-memory.dmp

Download

memory/2084-10-0x00000203F9E20000-0x00000203F9E42000-memory.dmp

Download

memory/4004-0-0x00007FF65BFF0000-0x00007FF65C212000-memory.dmp

Download

memory/4004-15-0x00007FF65BFF0000-0x00007FF65C212000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads