Analysis
- max time kernel
7s - max time network
14s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/03/2024, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
main.ps1
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target main.ps1
- Size 903B
- Sample240311-ynzdbscg4v
- SHA256 cbecf30ea18d44f240aaa8bb5a3a171b49d91193b10636948f4f511273c7950f
- MD5 a07ff90c5d04e86bb8dbf00b6cee7666
- SHA1 3f5d3068ff7f9a9eab445f47370ad3e9624e397d
- SHA512 5a1a8d90ba5e151c385f92bec7d3d74acaea62c76ce1cccd97f178cc89b85fd95f9c61dc903c8ed116a3a7df9759f9efe31b7ecf8515d8d71fd00794891040a9
- MD5 SHA1 SHA512
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings powershell.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1832 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1060 powershell.exe 1060 powershell.exe 1060 powershell.exe 1060 powershell.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1060 powershell.exe Token: SeIncreaseQuotaPrivilege 1060 powershell.exe Token: SeSecurityPrivilege 1060 powershell.exe Token: SeTakeOwnershipPrivilege 1060 powershell.exe Token: SeLoadDriverPrivilege 1060 powershell.exe Token: SeSystemProfilePrivilege 1060 powershell.exe Token: SeSystemtimePrivilege 1060 powershell.exe Token: SeProfSingleProcessPrivilege 1060 powershell.exe Token: SeIncBasePriorityPrivilege 1060 powershell.exe Token: SeCreatePagefilePrivilege 1060 powershell.exe Token: SeBackupPrivilege 1060 powershell.exe Token: SeRestorePrivilege 1060 powershell.exe Token: SeShutdownPrivilege 1060 powershell.exe Token: SeDebugPrivilege 1060 powershell.exe Token: SeSystemEnvironmentPrivilege 1060 powershell.exe Token: SeRemoteShutdownPrivilege 1060 powershell.exe Token: SeUndockPrivilege 1060 powershell.exe Token: SeManageVolumePrivilege 1060 powershell.exe Token: 33 1060 powershell.exe Token: 34 1060 powershell.exe Token: 35 1060 powershell.exe Token: 36 1060 powershell.exe Token: SeIncreaseQuotaPrivilege 1060 powershell.exe Token: SeSecurityPrivilege 1060 powershell.exe Token: SeTakeOwnershipPrivilege 1060 powershell.exe Token: SeLoadDriverPrivilege 1060 powershell.exe Token: SeSystemProfilePrivilege 1060 powershell.exe Token: SeSystemtimePrivilege 1060 powershell.exe Token: SeProfSingleProcessPrivilege 1060 powershell.exe Token: SeIncBasePriorityPrivilege 1060 powershell.exe Token: SeCreatePagefilePrivilege 1060 powershell.exe Token: SeBackupPrivilege 1060 powershell.exe Token: SeRestorePrivilege 1060 powershell.exe Token: SeShutdownPrivilege 1060 powershell.exe Token: SeDebugPrivilege 1060 powershell.exe Token: SeSystemEnvironmentPrivilege 1060 powershell.exe Token: SeRemoteShutdownPrivilege 1060 powershell.exe Token: SeUndockPrivilege 1060 powershell.exe Token: SeManageVolumePrivilege 1060 powershell.exe Token: 33 1060 powershell.exe Token: 34 1060 powershell.exe Token: 35 1060 powershell.exe Token: 36 1060 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2932 LogonUI.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1832 1060 powershell.exe 93 PID 1060 wrote to memory of 1832 1060 powershell.exe 93 PID 1060 wrote to memory of 3284 1060 powershell.exe 96 PID 1060 wrote to memory of 3284 1060 powershell.exe 96
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\main.ps11⤵
- UAC bypass
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Usernames_Passwords.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command & { Write-Host 'Get Tricked' }2⤵PID:3284
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ac855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Usernames_Passwords.txt
- Size 294B
- SHA256 1c934d629dbfe04a08f47640a5c00e986d304a86f20614c3d3d9582297e2d65a
- MD5 f48aa5b8934a8bdfa58148e42dbaf3fd
- SHA1 2dec12916ca190290044141b4c7ecf833d8b2551
- SHA512 46d9735e6bda8b2e87235b57b72d859e8411f7f0910fd222baa3c3cda0493fd63c8c467ced1130a19bbfa9b37498d0042c74276587da9ae0ce2d75c61526c300
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rbjql1q5.qir.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512