Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 01:36

General

  • Target

    129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d.ps1

  • Size

    5.1MB

  • MD5

    25c0fde038e01fe84fd3df69c99e60a1

  • SHA1

    147c1adc615daa93e84a5a9210ccc14ae86f6c55

  • SHA256

    129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d

  • SHA512

    8d666575c6570f5b128faf30d30f506259eda1907829bcf449c2407ea3aa943de46933bb3822b5fcddb25648ad8cc6f4d2077b29e82cdb4a6f423a5e1acc9fae

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1248
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\129a0f0f4dd667e3ecbcc252b890f306eb041ad0295cb1511343c307c12a658d.ps1
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1088
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zejl2rxy.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:764
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8538.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8527.tmp"
            4⤵
              PID:580
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qzhndn6i.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1492
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8805.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8804.tmp"
              4⤵
                PID:1480
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1804
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:368

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/764-63-0x0000000002240000-0x0000000002242000-memory.dmp

          Filesize

          8KB

        • memory/1088-54-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmp

          Filesize

          8KB

        • memory/1088-59-0x000000001B850000-0x000000001BB4F000-memory.dmp

          Filesize

          3.0MB

        • memory/1088-60-0x000000000292B000-0x000000000294A000-memory.dmp

          Filesize

          124KB

        • memory/1088-55-0x000007FEF2E30000-0x000007FEF398D000-memory.dmp

          Filesize

          11.4MB

        • memory/1088-58-0x0000000002924000-0x0000000002927000-memory.dmp

          Filesize

          12KB

        • memory/1088-57-0x0000000002922000-0x0000000002924000-memory.dmp

          Filesize

          8KB

        • memory/1088-56-0x0000000002920000-0x0000000002922000-memory.dmp

          Filesize

          8KB

        • memory/1248-74-0x0000000002B20000-0x0000000002B32000-memory.dmp

          Filesize

          72KB

        • memory/1248-75-0x0000000002B20000-0x0000000002B32000-memory.dmp

          Filesize

          72KB

        • memory/1804-81-0x0000000003E00000-0x00000000045EF000-memory.dmp

          Filesize

          7.9MB