Analysis

  • max time kernel
    133s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 12:31

General

  • Target

    Regretable/Prferencetolden/Alluder152/Brinie29.ps1

  • Size

    57KB

  • MD5

    606f3c0d77738574d051cf2f7140aafd

  • SHA1

    becf7fe1fe0af569c52c94abadc970cca66ec0a6

  • SHA256

    5bb0a1909d79ecf1060382416cd6df278b2be9af709e3b072ca983d62f9b4861

  • SHA512

    8bcd585c03b3e8a145a17da6c00e3423d6f0e00f8ca3c34959c49867f651371dd993478ef81e098a1cd8c8d9890c7d1c62ae0488f095b39d4f96278664b340e8

  • SSDEEP

    768:4wErrM7A/9QKnpZ2H0ZjGtEbT59AILrUuh1tOBt33K2LCgPFKGft1Csv2EzbnQdx:4/nR2UIEn0Mw4fOBJJDgsBbnQdRWLJSB

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Regretable\Prferencetolden\Alluder152\Brinie29.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:2652
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "2204" "1140"
        2⤵
          PID:2620
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2672

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259423771.txt

              Filesize

              1KB

              MD5

              8e976628e5825d43264341f2718e91d4

              SHA1

              9e3b0b601698a0427566aa4693c5ec896be0d07b

              SHA256

              1eb47c87e6bb6192bd082b7f2be679676ac30df7417a086e3884843524a0933d

              SHA512

              5997ffd274f3dd2c782de2cfb02c28018823bdb83aea7194c4e5cbbfc3f993dfcdc50e0a5905b624d8ba162ba871acc94be8251a64b166d39a47375db7d75c07

            • memory/2204-13-0x00000000027B0000-0x0000000002830000-memory.dmp

              Filesize

              512KB

            • memory/2204-17-0x00000000027B0000-0x0000000002830000-memory.dmp

              Filesize

              512KB

            • memory/2204-7-0x00000000027B0000-0x0000000002830000-memory.dmp

              Filesize

              512KB

            • memory/2204-8-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

              Filesize

              9.6MB

            • memory/2204-9-0x00000000027B0000-0x0000000002830000-memory.dmp

              Filesize

              512KB

            • memory/2204-10-0x00000000027B0000-0x0000000002830000-memory.dmp

              Filesize

              512KB

            • memory/2204-6-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

              Filesize

              9.6MB

            • memory/2204-14-0x000000001B9E0000-0x000000001B9E4000-memory.dmp

              Filesize

              16KB

            • memory/2204-11-0x00000000027B0000-0x0000000002830000-memory.dmp

              Filesize

              512KB

            • memory/2204-5-0x0000000002410000-0x0000000002418000-memory.dmp

              Filesize

              32KB

            • memory/2204-4-0x000000001B230000-0x000000001B512000-memory.dmp

              Filesize

              2.9MB

            • memory/2204-18-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

              Filesize

              9.6MB

            • memory/2672-19-0x0000000004310000-0x0000000004311000-memory.dmp

              Filesize

              4KB

            • memory/2672-20-0x0000000004310000-0x0000000004311000-memory.dmp

              Filesize

              4KB

            • memory/2672-24-0x00000000026E0000-0x00000000026F0000-memory.dmp

              Filesize

              64KB