0daec5d74297591bda4fb4aedd1c91643b7cd4312d65e5eb664d2328f0cd5c52

General

Target

Mellemregningen14.ps1
Size

50KB
MD5

c1a99f6520552a8cd0186b390887b21c
SHA1

1982354532b61d5a6f34758473ba8fa0d526aac9
SHA256

e6df54df126140a5a615ad2ef44fc375a6276080fd1c39ad6bd16dbb5e3c2204
SHA512

fe5f00348ca1e8a618dee573d45aeed609d91d24119a9b1609aa77c9cbb9ee901892c137020fb13bd037e316620c91a299cead1ff7f48a28713d450ba326a1be
SSDEEP

1536:Ph2HGRZuseVJyL798Baok5Ezn+Yx1dU7gLBwgR:KGruBJs7Ork5Y7s7MBwgR

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exe

pid	process
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2684 explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powershell.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

explorer.exe

pid	process
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

explorer.exe

pid	process
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe
2684	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 2312 wrote to memory of 2648	2312	powershell.exe	cmd.exe
PID 2312 wrote to memory of 2648	2312	powershell.exe	cmd.exe
PID 2312 wrote to memory of 2648	2312	powershell.exe	cmd.exe
PID 2312 wrote to memory of 2688	2312	powershell.exe	wermgr.exe
PID 2312 wrote to memory of 2688	2312	powershell.exe	wermgr.exe
PID 2312 wrote to memory of 2688	2312	powershell.exe	wermgr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Mellemregningen14.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
2⤵
PID:2648

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "2312" "1128"
2⤵
PID:2688

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259402053.txt

Filesize
1KB

MD5
ef0f54c4330e57fce7f9ad831e5fd36b

SHA1
d879e26c784dc1f0572d7b6a18a91bf6a60fe315

SHA256
675bdf1444971e29b58afdc89ff59b7551490632ea578bc52aba004bfa63562f

SHA512
227a963564e9b3d89c871916a738199c7ba9cf734ab4a6754a2a66939315a9e3aca4036ea9ba1a7d24153caceaab8399b9e014a2e28506b176017b45739d81fc

Download Submit
memory/2312-10-0x0000000002DF0000-0x0000000002E70000-memory.dmp

Filesize
512KB

Download
memory/2312-6-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/2312-7-0x0000000002DF0000-0x0000000002E70000-memory.dmp

Filesize
512KB

Download
memory/2312-8-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/2312-9-0x0000000002DF0000-0x0000000002E70000-memory.dmp

Filesize
512KB

Download
memory/2312-4-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2312-12-0x0000000002DF0000-0x0000000002E70000-memory.dmp

Filesize
512KB

Download
memory/2312-5-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/2312-14-0x00000000029B0000-0x00000000029B4000-memory.dmp

Filesize
16KB

Download
memory/2312-16-0x0000000002DF0000-0x0000000002E70000-memory.dmp

Filesize
512KB

Download
memory/2312-17-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/2684-18-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/2684-19-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/2684-23-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads