Analysis
-
max time kernel
193s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19-02-2024 09:22
General
-
Target
Melitta/Assonantic/evakueringsvelsers/Jakobskamp/Blyantstegninger.ps1
-
Size
42KB
-
MD5
a986fd781b75d8deae5059a8eaf9947b
-
SHA1
00e654981fe37b648a5799c04856830d83345736
-
SHA256
c2fb393897717d953dfd2ccfd179fccba1dbae00fa6c7a9ca46610b78b9ba085
-
SHA512
ccc7b6aacc718ab09d871e933227d02299e9c9c119669f15804d988b46d7ba0db45aedf6d1a61f4844ec091d6a6e9ef3e0557b3c50420693453a2df59c4b2545
-
SSDEEP
768:lq3bgwBoUUAvXmZR+FL6lYPl8ULiLBnQNHBivEWkS+gs19:816QXw+slYPZLilQLkEWkSs19
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 32 IoCs
-
Suspicious use of SendNotifyMessage 25 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Melitta\Assonantic\evakueringsvelsers\Jakobskamp\Blyantstegninger.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "3056" "880"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b502aac7dc22ad1b60d37241c4c3a6ea
SHA1fbd54a75237d224e3ee4510d8902e74a9438d692
SHA256de5bcb1cea7be20a80b7cd1cc1a0842441d88d013701d18f2a994e72f9fadf63
SHA512c0cc2c604db9b2134706e61c139624773fafea1c78f730a10c12316bb97f2307a9ce00c4511846148103708d61ca2fb25156c613ecd274c5c4f8e884bcf94e1e
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
16KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
32KB