4f3c0de5a08e918050382a42c6109fda68cc8167664065ebd98c73d761fde3f3

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PR-ZWL 07364G49574(Revised PO).exe
Size

759KB
MD5

6ef3cba91b136ae138380b710a104a12
SHA1

5347a8375a4faaca804d39b6e892241086be8986
SHA256

c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73
SHA512

f65fd41faa37b1eaca4f60f830fc4c22c43f91821489bbfa9340f65c16e8056cd331b4cf68d8223245cbca6c7493e837cf15b16dfe371ff0a95183a9813051c5
SSDEEP

12288:YgsrmyiqyJMbloYxlJHATl7Nn4JaywbIK/bOFNEpDg0891ZdujAC6lITYeMmR/E:QF5OyoY5ApZnRywbj/bieTi1ujAC6r37

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1656 powershell.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1032 icacls.exe

pid	process
1032	icacls.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

PR-ZWL 07364G49574(Revised PO).exePR-ZWL 07364G49574(Revised PO).exeicacls.exe

description	pid	process	target process
PID 1284 set thread context of 2600	1284	PR-ZWL 07364G49574(Revised PO).exe	PR-ZWL 07364G49574(Revised PO).exe
PID 2600 set thread context of 1204	2600	PR-ZWL 07364G49574(Revised PO).exe	Explorer.EXE
PID 2600 set thread context of 1032	2600	PR-ZWL 07364G49574(Revised PO).exe	icacls.exe
PID 1032 set thread context of 1204	1032	icacls.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

powershell.exePR-ZWL 07364G49574(Revised PO).exeicacls.exe

pid	process
1656	powershell.exe
2600	PR-ZWL 07364G49574(Revised PO).exe
2600	PR-ZWL 07364G49574(Revised PO).exe
2600	PR-ZWL 07364G49574(Revised PO).exe
2600	PR-ZWL 07364G49574(Revised PO).exe
2600	PR-ZWL 07364G49574(Revised PO).exe
2600	PR-ZWL 07364G49574(Revised PO).exe
2600	PR-ZWL 07364G49574(Revised PO).exe
2600	PR-ZWL 07364G49574(Revised PO).exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe
1032	icacls.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

PR-ZWL 07364G49574(Revised PO).exeExplorer.EXEicacls.exe

pid process

2600 PR-ZWL 07364G49574(Revised PO).exe
1204 Explorer.EXE
1204 Explorer.EXE
1032 icacls.exe
1032 icacls.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1656 powershell.exe

pid	process
2600	PR-ZWL 07364G49574(Revised PO).exe
1204	Explorer.EXE
1204	Explorer.EXE
1032	icacls.exe
1032	icacls.exe

description	pid	process
Token: SeDebugPrivilege	1656	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PR-ZWL 07364G49574(Revised PO).exeExplorer.EXE

description	pid	process	target process
PID 1284 wrote to memory of 1656	1284	PR-ZWL 07364G49574(Revised PO).exe	powershell.exe
PID 1284 wrote to memory of 1656	1284	PR-ZWL 07364G49574(Revised PO).exe	powershell.exe
PID 1284 wrote to memory of 1656	1284	PR-ZWL 07364G49574(Revised PO).exe	powershell.exe
PID 1284 wrote to memory of 1656	1284	PR-ZWL 07364G49574(Revised PO).exe	powershell.exe
PID 1284 wrote to memory of 2600	1284	PR-ZWL 07364G49574(Revised PO).exe	PR-ZWL 07364G49574(Revised PO).exe
PID 1284 wrote to memory of 2600	1284	PR-ZWL 07364G49574(Revised PO).exe	PR-ZWL 07364G49574(Revised PO).exe
PID 1284 wrote to memory of 2600	1284	PR-ZWL 07364G49574(Revised PO).exe	PR-ZWL 07364G49574(Revised PO).exe
PID 1284 wrote to memory of 2600	1284	PR-ZWL 07364G49574(Revised PO).exe	PR-ZWL 07364G49574(Revised PO).exe
PID 1284 wrote to memory of 2600	1284	PR-ZWL 07364G49574(Revised PO).exe	PR-ZWL 07364G49574(Revised PO).exe
PID 1284 wrote to memory of 2600	1284	PR-ZWL 07364G49574(Revised PO).exe	PR-ZWL 07364G49574(Revised PO).exe
PID 1284 wrote to memory of 2600	1284	PR-ZWL 07364G49574(Revised PO).exe	PR-ZWL 07364G49574(Revised PO).exe
PID 1204 wrote to memory of 1032	1204	Explorer.EXE	icacls.exe
PID 1204 wrote to memory of 1032	1204	Explorer.EXE	icacls.exe
PID 1204 wrote to memory of 1032	1204	Explorer.EXE	icacls.exe
PID 1204 wrote to memory of 1032	1204	Explorer.EXE	icacls.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\PR-ZWL 07364G49574(Revised PO).exe
"C:\Users\Admin\AppData\Local\Temp\PR-ZWL 07364G49574(Revised PO).exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PR-ZWL 07364G49574(Revised PO).exe"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Users\Admin\AppData\Local\Temp\PR-ZWL 07364G49574(Revised PO).exe
"C:\Users\Admin\AppData\Local\Temp\PR-ZWL 07364G49574(Revised PO).exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2600

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\SysWOW64\icacls.exe"
2⤵
- Modifies file permissions
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1032

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-21-0x0000000000080000-0x00000000000BE000-memory.dmp

Filesize
248KB

Download
memory/1032-19-0x0000000000080000-0x00000000000BE000-memory.dmp

Filesize
248KB

Download
memory/1204-18-0x0000000003A60000-0x0000000003B60000-memory.dmp

Filesize
1024KB

Download
memory/1284-13-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/1284-1-0x0000000000BD0000-0x0000000000C94000-memory.dmp

Filesize
784KB

Download
memory/1284-2-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/1284-3-0x0000000000440000-0x0000000000456000-memory.dmp

Filesize
88KB

Download
memory/1284-4-0x0000000000B60000-0x0000000000B6E000-memory.dmp

Filesize
56KB

Download
memory/1284-5-0x0000000000B70000-0x0000000000B80000-memory.dmp

Filesize
64KB

Download
memory/1284-6-0x0000000005C30000-0x0000000005CBA000-memory.dmp

Filesize
552KB

Download
memory/1284-0-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/2600-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads