Analysis
-
max time kernel
133s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16/03/2024, 02:36
General
-
Target
Paleobotanically112/Folkeeventyr/Akvatinterne.ps1
-
Size
53KB
-
MD5
323e8c1ff4fc2c93ae5671c534654b5e
-
SHA1
f70526e464a4c3368b4e406078c6a6fe183cd71e
-
SHA256
e14799666e4969a2265ee8d4a58aee35e675ea564b7539823e4d803be0ba8b82
-
SHA512
6f29c8a9a606009762793885de43d5e8bf1327b001536315edb79de35edc5f0b427c30bae95bb29f3b409196613fe29c84d16d9b2935807b709b2c069d0cc561
-
SSDEEP
1536:Cmy4JXRmObSB+bRKyTo39ImbKRfyz7a3M:NJ2B+6efywM
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Paleobotanically112\Folkeeventyr\Akvatinterne.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2972" "1132"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ea98fd6f492aa6be7cb9f3376b1a9827
SHA10a6e881837c825fb9861778e43eb45aef916cf85
SHA256d5e38af3b4ffa86593db96b96f272e9662e2f72a490e256fc83d4f7656a42a24
SHA512855bf1a60ad650310bc14ab5f354f1d9ec56ece9ba5f2539fff856beabd21e25f5ae4fe96acd58438c3fb901cf95c698bdc1c207dd545a44f4fb69b5c84a0d2c
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
16KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB