Analysis

  • max time kernel
    133s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/03/2024, 23:31

General

  • Target

    Fdrelandskrligehed/Tenuto/Sauria/Handelsbalancerne122.ps1

  • Size

    57KB

  • MD5

    0c865acf7c347c6dd359f98c8251a9bc

  • SHA1

    dc6ad24450f7a966e5c090abce2ec06f23cef9ae

  • SHA256

    00f3155ff5edff6c7b7286095854eae05446345e358018fee4c5fb141a458d7e

  • SHA512

    a7ead01800f440b0d4e8f07040818ed72ff1c768cb44ffc1823230b5bee96238b25373a652be4509c88cb371772da1061f5b14b3fa5a7e1e7833dc07d56f1aaa

  • SSDEEP

    1536:zSoQQtIqgBuwNgZdhr1l4jOLjMr0q7hB5V6jNpCDWS6BuqVkzW:eoKBuwN+3COLwr0q7f5iNY6XiS

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Fdrelandskrligehed\Tenuto\Sauria\Handelsbalancerne122.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:2728
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "1976" "1124"
        2⤵
          PID:2452
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2472

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259405216.txt

        Filesize

        1KB

        MD5

        17dcc32f8e6d7595b254902573c1e8f7

        SHA1

        44795c63401d80a04e5eb4f17266f64212f12c00

        SHA256

        e7e13a406f79625d913dadfdda166bb6886a493925354e108ea30c7964378e60

        SHA512

        5b4f947253b0d317feaf42b80d9f093024f53114b1cd28b56a0111c1946fb73a73a568ab5bc7f1ff346f1b329702f47e2e293caef251db114456d6f7649a3bc0

      • memory/1976-10-0x0000000002C60000-0x0000000002CE0000-memory.dmp

        Filesize

        512KB

      • memory/1976-13-0x0000000002C60000-0x0000000002CE0000-memory.dmp

        Filesize

        512KB

      • memory/1976-7-0x0000000002C60000-0x0000000002CE0000-memory.dmp

        Filesize

        512KB

      • memory/1976-8-0x000007FEF5C80000-0x000007FEF661D000-memory.dmp

        Filesize

        9.6MB

      • memory/1976-11-0x0000000002C60000-0x0000000002CE0000-memory.dmp

        Filesize

        512KB

      • memory/1976-4-0x000000001B810000-0x000000001BAF2000-memory.dmp

        Filesize

        2.9MB

      • memory/1976-9-0x0000000002C60000-0x0000000002CE0000-memory.dmp

        Filesize

        512KB

      • memory/1976-5-0x0000000000350000-0x0000000000358000-memory.dmp

        Filesize

        32KB

      • memory/1976-16-0x0000000002AC0000-0x0000000002AC4000-memory.dmp

        Filesize

        16KB

      • memory/1976-6-0x000007FEF5C80000-0x000007FEF661D000-memory.dmp

        Filesize

        9.6MB

      • memory/1976-17-0x0000000002C60000-0x0000000002CE0000-memory.dmp

        Filesize

        512KB

      • memory/1976-18-0x000007FEF5C80000-0x000007FEF661D000-memory.dmp

        Filesize

        9.6MB

      • memory/2472-19-0x0000000004320000-0x0000000004321000-memory.dmp

        Filesize

        4KB

      • memory/2472-20-0x0000000004320000-0x0000000004321000-memory.dmp

        Filesize

        4KB