Analysis

  • max time kernel
    133s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/03/2024, 07:30

General

  • Target

    Fangarme/Unfrocked/Beside.ps1

  • Size

    57KB

  • MD5

    4b7717b799924b965c87395fd3525e75

  • SHA1

    497905fee98b47d49d2a307e63a3a150e9024da4

  • SHA256

    3328223bc86a8827b1790755d0c91c6b7f3cea91b18f8cfb24247ca0526ecf60

  • SHA512

    eabcd57e04d51874ef723663443f4f61abd1a11877f9c78e9724e1af0407f8f89fe4e22df66af96f3a3654b77fb197c8d93235764d52b3a91c513fed8a66ba0e

  • SSDEEP

    768:W/CIxu9s4ROzL5W7brBAkk9uBsiSq2mGj2hwHjhImHYlNQmu+DVgku/thQk:UyxRO3I7tyiSq2Xj2hSQnWEmN/TQk

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Fangarme\Unfrocked\Beside.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:2400
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "2020" "1132"
        2⤵
          PID:3052
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1984

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259407039.txt

        Filesize

        1KB

        MD5

        17143dfa8cdc3636b7c8b937a2dd069d

        SHA1

        b27ec9e178354c8125e1bdebe87b3a8a41f903ee

        SHA256

        032c2a22b8e8086df71810889cf13aa1bc562eb8ed29f337a2645ad7c85a2f39

        SHA512

        e9c9c269b92728efd60fd76c6be8b35b69a0e75a23558f4a99bdc2e0a08090904b833becd539e567b37e1d4fc936e9e3c5dab5da2b2645e28aeb2c1d24336200

      • memory/1984-24-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

        Filesize

        64KB

      • memory/1984-20-0x0000000004410000-0x0000000004411000-memory.dmp

        Filesize

        4KB

      • memory/1984-19-0x0000000004410000-0x0000000004411000-memory.dmp

        Filesize

        4KB

      • memory/2020-13-0x0000000001EE0000-0x0000000001F60000-memory.dmp

        Filesize

        512KB

      • memory/2020-9-0x0000000001EE0000-0x0000000001F60000-memory.dmp

        Filesize

        512KB

      • memory/2020-10-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

        Filesize

        9.6MB

      • memory/2020-11-0x0000000001EE0000-0x0000000001F60000-memory.dmp

        Filesize

        512KB

      • memory/2020-5-0x000000001B520000-0x000000001B802000-memory.dmp

        Filesize

        2.9MB

      • memory/2020-14-0x000000001BC10000-0x000000001BC14000-memory.dmp

        Filesize

        16KB

      • memory/2020-8-0x0000000001EE0000-0x0000000001F60000-memory.dmp

        Filesize

        512KB

      • memory/2020-17-0x0000000001EE0000-0x0000000001F60000-memory.dmp

        Filesize

        512KB

      • memory/2020-18-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

        Filesize

        9.6MB

      • memory/2020-4-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

        Filesize

        9.6MB

      • memory/2020-6-0x0000000001EE0000-0x0000000001F60000-memory.dmp

        Filesize

        512KB

      • memory/2020-7-0x00000000021C0000-0x00000000021C8000-memory.dmp

        Filesize

        32KB