Analysis
-
max time kernel
135s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/03/2024, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
RefTechnical Drawing Sheet.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RefTechnical Drawing Sheet.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Bedwarmer.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Bedwarmer.ps1
Resource
win10v2004-20240226-en
General
-
Target
Bedwarmer.ps1
-
Size
58KB
-
MD5
aae5fcb1e66470ef7a08ea335b80ac05
-
SHA1
9422c0898c87a134c72c6ffa35c594d93dba9dc9
-
SHA256
8bd9205c7c8f112ff5cba1307842eddccc18e20e227cccb7b74e6a24e686b8b0
-
SHA512
031d187a47a9b687d6822f34e74029f2f1cf4eb8687dc2846a3d84efbf9d30d5459870842a22cdab89130915501e2593f79b2a32da5c266d382120e0a042b072
-
SSDEEP
1536:kIA6tvaB6ot7AWRT/HFQzHYDLaKzxxkRq:kIltiBhzlQELaKzjD
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2548 explorer.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2020 powershell.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe Token: SeShutdownPrivilege 2548 explorer.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2940 2020 powershell.exe 29 PID 2020 wrote to memory of 2940 2020 powershell.exe 29 PID 2020 wrote to memory of 2940 2020 powershell.exe 29 PID 2020 wrote to memory of 1052 2020 powershell.exe 33 PID 2020 wrote to memory of 1052 2020 powershell.exe 33 PID 2020 wrote to memory of 1052 2020 powershell.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Bedwarmer.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵PID:2940
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2020" "1144"2⤵PID:1052
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ec7faa677e4d83a601e17cf1dace127b
SHA188178e7bfde8ae1d04ef2dcbf955519b7c26a048
SHA25643036badd8673e65713a6dcf5de54dd5c7942117a5df3de7ddd666c259b72274
SHA512ae14841bd5c7c551962bf38aab5ff268a441530791f821bdf34ca96574eaae9e0ef0f102e0e5ee9409e55146fcccd3fb0303f579046088c37019af2a48ff8210