Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/03/2024, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quotation Details_Ref.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Request For Quotation Details_Ref.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Fangarme/Unfrocked/Beside.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Fangarme/Unfrocked/Beside.ps1
Resource
win10v2004-20240226-en
General
-
Target
Fangarme/Unfrocked/Beside.ps1
-
Size
57KB
-
MD5
4b7717b799924b965c87395fd3525e75
-
SHA1
497905fee98b47d49d2a307e63a3a150e9024da4
-
SHA256
3328223bc86a8827b1790755d0c91c6b7f3cea91b18f8cfb24247ca0526ecf60
-
SHA512
eabcd57e04d51874ef723663443f4f61abd1a11877f9c78e9724e1af0407f8f89fe4e22df66af96f3a3654b77fb197c8d93235764d52b3a91c513fed8a66ba0e
-
SSDEEP
768:W/CIxu9s4ROzL5W7brBAkk9uBsiSq2mGj2hwHjhImHYlNQmu+DVgku/thQk:UyxRO3I7tyiSq2Xj2hSQnWEmN/TQk
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1984 explorer.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2020 powershell.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2400 2020 powershell.exe 29 PID 2020 wrote to memory of 2400 2020 powershell.exe 29 PID 2020 wrote to memory of 2400 2020 powershell.exe 29 PID 2020 wrote to memory of 3052 2020 powershell.exe 31 PID 2020 wrote to memory of 3052 2020 powershell.exe 31 PID 2020 wrote to memory of 3052 2020 powershell.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Fangarme\Unfrocked\Beside.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵PID:2400
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2020" "1132"2⤵PID:3052
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD517143dfa8cdc3636b7c8b937a2dd069d
SHA1b27ec9e178354c8125e1bdebe87b3a8a41f903ee
SHA256032c2a22b8e8086df71810889cf13aa1bc562eb8ed29f337a2645ad7c85a2f39
SHA512e9c9c269b92728efd60fd76c6be8b35b69a0e75a23558f4a99bdc2e0a08090904b833becd539e567b37e1d4fc936e9e3c5dab5da2b2645e28aeb2c1d24336200