Analysis
-
max time kernel
133s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/03/2024, 23:33
Static task
static1
Behavioral task
behavioral1
Sample
RefTechnical Drawing Sheet.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RefTechnical Drawing Sheet.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Fdrelandskrligehed/Tenuto/Sauria/Handelsbalancerne122.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Fdrelandskrligehed/Tenuto/Sauria/Handelsbalancerne122.ps1
Resource
win10v2004-20240226-en
General
-
Target
Fdrelandskrligehed/Tenuto/Sauria/Handelsbalancerne122.ps1
-
Size
57KB
-
MD5
0c865acf7c347c6dd359f98c8251a9bc
-
SHA1
dc6ad24450f7a966e5c090abce2ec06f23cef9ae
-
SHA256
00f3155ff5edff6c7b7286095854eae05446345e358018fee4c5fb141a458d7e
-
SHA512
a7ead01800f440b0d4e8f07040818ed72ff1c768cb44ffc1823230b5bee96238b25373a652be4509c88cb371772da1061f5b14b3fa5a7e1e7833dc07d56f1aaa
-
SSDEEP
1536:zSoQQtIqgBuwNgZdhr1l4jOLjMr0q7hB5V6jNpCDWS6BuqVkzW:eoKBuwN+3COLwr0q7f5iNY6XiS
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 explorer.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 1500 powershell.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe Token: SeShutdownPrivilege 2596 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2896 1500 powershell.exe 29 PID 1500 wrote to memory of 2896 1500 powershell.exe 29 PID 1500 wrote to memory of 2896 1500 powershell.exe 29 PID 1500 wrote to memory of 1484 1500 powershell.exe 33 PID 1500 wrote to memory of 1484 1500 powershell.exe 33 PID 1500 wrote to memory of 1484 1500 powershell.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Fdrelandskrligehed\Tenuto\Sauria\Handelsbalancerne122.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵PID:2896
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1500" "1136"2⤵PID:1484
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5303376ba8a503ebbc758f8f318802244
SHA1537e9bd7b68caa8f2d4fcd52603030006729defb
SHA25603c64c2c0007b316c1ba91bf7c69d0b57f21e5c85a80effdb34b4bdb76662280
SHA512720dd8e11c1576758f05fcee4ad281a6e553999c52e77290a243c26c98c94a0d2a2e622509f9082ce6daa12038ce13f4d4667a9e2dfe3ff0e53bff3c1106123a