Analysis
-
max time kernel
133s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
21/02/2024, 03:33
General
-
Target
Melitta/Assonantic/evakueringsvelsers/Jakobskamp/Blyantstegninger.ps1
-
Size
42KB
-
MD5
a986fd781b75d8deae5059a8eaf9947b
-
SHA1
00e654981fe37b648a5799c04856830d83345736
-
SHA256
c2fb393897717d953dfd2ccfd179fccba1dbae00fa6c7a9ca46610b78b9ba085
-
SHA512
ccc7b6aacc718ab09d871e933227d02299e9c9c119669f15804d988b46d7ba0db45aedf6d1a61f4844ec091d6a6e9ef3e0557b3c50420693453a2df59c4b2545
-
SSDEEP
768:lq3bgwBoUUAvXmZR+FL6lYPl8ULiLBnQNHBivEWkS+gs19:816QXw+slYPZLilQLkEWkSs19
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Melitta\Assonantic\evakueringsvelsers\Jakobskamp\Blyantstegninger.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2932" "880"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bef80cb01e561403f21092ced13c9883
SHA1475b42b037290575447a4853b051e0588b820267
SHA2563b31a7ac836d72e874d9e8372cc585f1b9dc3a14512b35f17ab10a677e6fdd9a
SHA51214d3b1a28862ae6162578c2d02d245e02b665ff7fd846ad2b2543cb5fe8e42784406a4467800684bb3307559a1a88e70d97afbdf7a358871052aff4eba663bb8
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
16KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
32KB