Analysis

  • max time kernel
    133s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 12:33

General

  • Target

    Regretable/Prferencetolden/Alluder152/Brinie29.ps1

  • Size

    57KB

  • MD5

    606f3c0d77738574d051cf2f7140aafd

  • SHA1

    becf7fe1fe0af569c52c94abadc970cca66ec0a6

  • SHA256

    5bb0a1909d79ecf1060382416cd6df278b2be9af709e3b072ca983d62f9b4861

  • SHA512

    8bcd585c03b3e8a145a17da6c00e3423d6f0e00f8ca3c34959c49867f651371dd993478ef81e098a1cd8c8d9890c7d1c62ae0488f095b39d4f96278664b340e8

  • SSDEEP

    768:4wErrM7A/9QKnpZ2H0ZjGtEbT59AILrUuh1tOBt33K2LCgPFKGft1Csv2EzbnQdx:4/nR2UIEn0Mw4fOBJJDgsBbnQdRWLJSB

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Regretable\Prferencetolden\Alluder152\Brinie29.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:2640
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "2212" "1140"
        2⤵
          PID:2752
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2620

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259413108.txt

              Filesize

              1KB

              MD5

              e308c7d876f9e1bedfc20cd069741ba2

              SHA1

              97d0805eb39ee7faeae45566e32e949861986d2b

              SHA256

              1ba96efd582b17022a9ad0052fc6f153e5240bd03f8df2f008cc467982cdf4ec

              SHA512

              d5db32419a9e7ad61b20da4a8106032bdb82df107af513fa14c2702b409e954cd0463b76b0a5dbcb934a2a67ad57275a3b444f6eee0c7e465de0fe3d5d7e7c11

            • memory/2212-7-0x0000000002A00000-0x0000000002A80000-memory.dmp

              Filesize

              512KB

            • memory/2212-13-0x0000000002B90000-0x0000000002B94000-memory.dmp

              Filesize

              16KB

            • memory/2212-4-0x000000001B470000-0x000000001B752000-memory.dmp

              Filesize

              2.9MB

            • memory/2212-8-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

              Filesize

              9.6MB

            • memory/2212-9-0x0000000002A00000-0x0000000002A80000-memory.dmp

              Filesize

              512KB

            • memory/2212-10-0x0000000002A00000-0x0000000002A80000-memory.dmp

              Filesize

              512KB

            • memory/2212-12-0x0000000002A00000-0x0000000002A80000-memory.dmp

              Filesize

              512KB

            • memory/2212-6-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

              Filesize

              9.6MB

            • memory/2212-5-0x00000000023F0000-0x00000000023F8000-memory.dmp

              Filesize

              32KB

            • memory/2212-16-0x0000000002A00000-0x0000000002A80000-memory.dmp

              Filesize

              512KB

            • memory/2212-17-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

              Filesize

              9.6MB

            • memory/2620-18-0x0000000003C20000-0x0000000003C21000-memory.dmp

              Filesize

              4KB

            • memory/2620-19-0x0000000003C20000-0x0000000003C21000-memory.dmp

              Filesize

              4KB

            • memory/2620-23-0x00000000025F0000-0x0000000002600000-memory.dmp

              Filesize

              64KB