Analysis

  • max time kernel
    164s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/03/2024, 08:02

General

  • Target

    Fangarme/Unfrocked/Beside.ps1

  • Size

    57KB

  • MD5

    4b7717b799924b965c87395fd3525e75

  • SHA1

    497905fee98b47d49d2a307e63a3a150e9024da4

  • SHA256

    3328223bc86a8827b1790755d0c91c6b7f3cea91b18f8cfb24247ca0526ecf60

  • SHA512

    eabcd57e04d51874ef723663443f4f61abd1a11877f9c78e9724e1af0407f8f89fe4e22df66af96f3a3654b77fb197c8d93235764d52b3a91c513fed8a66ba0e

  • SSDEEP

    768:W/CIxu9s4ROzL5W7brBAkk9uBsiSq2mGj2hwHjhImHYlNQmu+DVgku/thQk:UyxRO3I7tyiSq2Xj2hSQnWEmN/TQk

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Fangarme\Unfrocked\Beside.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:1112
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "2560" "1140"
        2⤵
          PID:1020
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2460

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259466243.txt

        Filesize

        1KB

        MD5

        b2102cde442f38c00c2496d22d243e0e

        SHA1

        3bdc8dca4ded67a8b3a25cc7576d37b6dd3e51cf

        SHA256

        6775c41ec98cdf45cca64826a77e557f5ca69ec17eed38f7a986844015a9e308

        SHA512

        fe597015d5c12372d6c474e41c148b2fb56dfda329e5011a5c8e21a5d5de99e696a65ebc6b912d276421ff4b6be1b2ea2d3c33449091c40fe629340c10c7b6b3

      • memory/2460-13-0x0000000003F20000-0x0000000003F21000-memory.dmp

        Filesize

        4KB

      • memory/2460-24-0x00000000025C0000-0x00000000025D0000-memory.dmp

        Filesize

        64KB

      • memory/2460-20-0x0000000003F20000-0x0000000003F21000-memory.dmp

        Filesize

        4KB

      • memory/2560-7-0x0000000002270000-0x0000000002278000-memory.dmp

        Filesize

        32KB

      • memory/2560-6-0x0000000002740000-0x00000000027C0000-memory.dmp

        Filesize

        512KB

      • memory/2560-10-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

        Filesize

        9.6MB

      • memory/2560-11-0x0000000002740000-0x00000000027C0000-memory.dmp

        Filesize

        512KB

      • memory/2560-5-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

        Filesize

        9.6MB

      • memory/2560-14-0x0000000002740000-0x00000000027C0000-memory.dmp

        Filesize

        512KB

      • memory/2560-15-0x0000000002880000-0x0000000002884000-memory.dmp

        Filesize

        16KB

      • memory/2560-8-0x0000000002740000-0x00000000027C0000-memory.dmp

        Filesize

        512KB

      • memory/2560-18-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

        Filesize

        9.6MB

      • memory/2560-19-0x0000000002740000-0x00000000027C0000-memory.dmp

        Filesize

        512KB

      • memory/2560-9-0x0000000002740000-0x00000000027C0000-memory.dmp

        Filesize

        512KB

      • memory/2560-4-0x000000001B310000-0x000000001B5F2000-memory.dmp

        Filesize

        2.9MB