Analysis
-
max time kernel
164s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/03/2024, 08:02
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quotation DetailsRef.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Request For Quotation DetailsRef.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Fangarme/Unfrocked/Beside.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Fangarme/Unfrocked/Beside.ps1
Resource
win10v2004-20231215-en
General
-
Target
Fangarme/Unfrocked/Beside.ps1
-
Size
57KB
-
MD5
4b7717b799924b965c87395fd3525e75
-
SHA1
497905fee98b47d49d2a307e63a3a150e9024da4
-
SHA256
3328223bc86a8827b1790755d0c91c6b7f3cea91b18f8cfb24247ca0526ecf60
-
SHA512
eabcd57e04d51874ef723663443f4f61abd1a11877f9c78e9724e1af0407f8f89fe4e22df66af96f3a3654b77fb197c8d93235764d52b3a91c513fed8a66ba0e
-
SSDEEP
768:W/CIxu9s4ROzL5W7brBAkk9uBsiSq2mGj2hwHjhImHYlNQmu+DVgku/thQk:UyxRO3I7tyiSq2Xj2hSQnWEmN/TQk
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2560 powershell.exe 2560 powershell.exe 2560 powershell.exe 2560 powershell.exe 2560 powershell.exe 2560 powershell.exe 2560 powershell.exe 2560 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2460 explorer.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2560 powershell.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe Token: SeShutdownPrivilege 2460 explorer.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe -
Suspicious use of SendNotifyMessage 21 IoCs
pid Process 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe 2460 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2560 wrote to memory of 1112 2560 powershell.exe 30 PID 2560 wrote to memory of 1112 2560 powershell.exe 30 PID 2560 wrote to memory of 1112 2560 powershell.exe 30 PID 2560 wrote to memory of 1020 2560 powershell.exe 34 PID 2560 wrote to memory of 1020 2560 powershell.exe 34 PID 2560 wrote to memory of 1020 2560 powershell.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Fangarme\Unfrocked\Beside.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵PID:1112
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2560" "1140"2⤵PID:1020
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b2102cde442f38c00c2496d22d243e0e
SHA13bdc8dca4ded67a8b3a25cc7576d37b6dd3e51cf
SHA2566775c41ec98cdf45cca64826a77e557f5ca69ec17eed38f7a986844015a9e308
SHA512fe597015d5c12372d6c474e41c148b2fb56dfda329e5011a5c8e21a5d5de99e696a65ebc6b912d276421ff4b6be1b2ea2d3c33449091c40fe629340c10c7b6b3