Analysis

  • max time kernel
    133s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2024 07:02

General

  • Target

    Handelshindringens.ps1

  • Size

    49KB

  • MD5

    26ac3d358904de47313a08e6e95b9ef8

  • SHA1

    d8cb62fa3f065244d37862489962401a3c829a9a

  • SHA256

    a87dc179ea36df155f5d8b7a8a5963ef1de61fa7032db510a8a1f64033182ff2

  • SHA512

    efc8932a6e6cb055fd76603cade1ce298c2d19f250d9e3234255f55b2ec28b6c34345f35a017816b35400a4258eb0cca8fdf885a1c8b5f0c08f50731d17bae71

  • SSDEEP

    1536:8cdYRGdh2mJBi9i2cMJC/uvyxOd8maeZ1q6KwDN2C:Bbh7J+5CHxOdbn1qr2Nh

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Handelshindringens.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:2624
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "2192" "1128"
        2⤵
          PID:2732
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2460

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259397025.txt

        Filesize

        1KB

        MD5

        b60854532e7d431b601b81d321a6e270

        SHA1

        acf18462cf86f6a2cc0c9238b1eb48b0c4b7caea

        SHA256

        0aa4f8121f5fd08d1fb449ecd2b91ea62d2449acb38fc908e2acab48eb843b22

        SHA512

        5ba75c18e8917e3289b60ff0e901abb2d9492982caa9ab38da163f4dfc92a270913bbe4ab8422ee71fe46de3bc23b48725832c5cfba97f6fd5fa05625da8d46b

      • memory/2192-13-0x0000000002A30000-0x0000000002AB0000-memory.dmp

        Filesize

        512KB

      • memory/2192-15-0x000000001BC90000-0x000000001BC94000-memory.dmp

        Filesize

        16KB

      • memory/2192-5-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

        Filesize

        9.6MB

      • memory/2192-8-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

        Filesize

        9.6MB

      • memory/2192-9-0x0000000002A30000-0x0000000002AB0000-memory.dmp

        Filesize

        512KB

      • memory/2192-11-0x0000000002A30000-0x0000000002AB0000-memory.dmp

        Filesize

        512KB

      • memory/2192-7-0x0000000002A30000-0x0000000002AB0000-memory.dmp

        Filesize

        512KB

      • memory/2192-4-0x000000001B5A0000-0x000000001B882000-memory.dmp

        Filesize

        2.9MB

      • memory/2192-10-0x0000000002A30000-0x0000000002AB0000-memory.dmp

        Filesize

        512KB

      • memory/2192-6-0x0000000002A10000-0x0000000002A18000-memory.dmp

        Filesize

        32KB

      • memory/2192-17-0x0000000002A30000-0x0000000002AB0000-memory.dmp

        Filesize

        512KB

      • memory/2192-18-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

        Filesize

        9.6MB

      • memory/2460-19-0x00000000041E0000-0x00000000041E1000-memory.dmp

        Filesize

        4KB

      • memory/2460-20-0x00000000041E0000-0x00000000041E1000-memory.dmp

        Filesize

        4KB

      • memory/2460-24-0x0000000002610000-0x0000000002620000-memory.dmp

        Filesize

        64KB