3bc0bb886fcfd4fa94d9d6f6d12151f45bca11d6fdf630524963d995e0598e30

General

Target

$_20_/skarpskytten.ps1
Size

60KB
MD5

4e54c10f7cd7930f6c3233586843a34b
SHA1

413600b893318c6ef5eca31610065932da025813
SHA256

d4cb9851ac7b4d628788e5c8ab238d992105d7818ee7d126c490452476774775
SHA512

891b9c024af8fba3497b2b17a2ad8dd3c5e0adde83bc787905a577b09d632a257f068fff1ad90c82f7115f595c249d4c7fcc9d51c946fcc0b42f60ea87e06221
SSDEEP

768:hyOqx/TlpDJhVUY4sgJEfRKIFfnJXYX5fB/+J8bmBmtCPQWOSngoShfk0Ojo1tf1:WtLHOPJgLeX5ZegyQVV7v71jxMT4

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exe

pid	process
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2688 explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powershell.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe
Token: SeShutdownPrivilege	2688	explorer.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

explorer.exe

pid	process
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe

Suspicious use of SendNotifyMessage 19 IoCs

Processes:

explorer.exe

pid	process
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 2488 wrote to memory of 2796	2488	powershell.exe	cmd.exe
PID 2488 wrote to memory of 2796	2488	powershell.exe	cmd.exe
PID 2488 wrote to memory of 2796	2488	powershell.exe	cmd.exe
PID 2488 wrote to memory of 2752	2488	powershell.exe	wermgr.exe
PID 2488 wrote to memory of 2752	2488	powershell.exe	wermgr.exe
PID 2488 wrote to memory of 2752	2488	powershell.exe	wermgr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$_20_\skarpskytten.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
2⤵
PID:2796

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "2488" "1144"
2⤵
PID:2752

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2688

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259440262.txt
Filesize
1KB

MD5
226b4eba50cb0ab471bd78d887d0d0bc

SHA1
c5e95ad933f8c0aaae2f01060aec2ab067089227

SHA256
070d79d045eb4e86f776c6cf9b973623ab2d4e158866f971484e0557fbc7506f

SHA512
771362b19ecebaa3aee1cbf55b72bb7e61d0279c2cf6f42fb590c8b91ad8202db262f87024b0edb51316b2a0c52755ddb9193701af1f44e238742e461bd00f7b

Download Submit
memory/2488-13-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/2488-14-0x000000001B1F0000-0x000000001B1F4000-memory.dmp

Filesize
16KB

Download
memory/2488-7-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/2488-8-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

Filesize
9.6MB

Download
memory/2488-9-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/2488-10-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/2488-6-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

Filesize
9.6MB

Download
memory/2488-4-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/2488-12-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/2488-5-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/2488-17-0x0000000002310000-0x0000000002390000-memory.dmp

Filesize
512KB

Download
memory/2488-18-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-19-0x0000000004150000-0x0000000004151000-memory.dmp

Filesize
4KB

Download
memory/2688-20-0x0000000004150000-0x0000000004151000-memory.dmp

Filesize
4KB

Download
memory/2688-24-0x0000000002730000-0x0000000002740000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads