00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3

General

Target

Pyrograph/Perikoner/Intermeasuring199/Skibshandlernes.ps1
Size

58KB
MD5

161d266563cfa870571bd2a76a200777
SHA1

4dad793c0fc2ff315bd201e80cf414864bea5409
SHA256

33095bc104b3928f5a857d2572be6afe3b9890ae110cd9aaf52ceb6a29e943fd
SHA512

430418fa2d550afd8f616420020c1c3d452488d45ba0d0d1b1a296ecc21eca816810872adce077612f12f88a1130c111560cba48b6286f06fb9ac6305729980a
SSDEEP

768:X7Etn9kgxHh0sMNB7kPM2OdEpivZnGL3tZDPrKY1U4CibG3WCnct7dbmsd5apjk5:tgxHGD7kPLOd0My3vCiGHctn3l8i

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exe

pid process

620 powershell.exe
620 powershell.exe
620 powershell.exe
620 powershell.exe
620 powershell.exe
620 powershell.exe
620 powershell.exe
620 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2576 explorer.exe

pid	process
620	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe
620	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powershell.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	620	powershell.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe

Suspicious use of FindShellTrayWindow 31 IoCs

Processes:

explorer.exe

pid	process
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe

Suspicious use of SendNotifyMessage 19 IoCs

Processes:

explorer.exe

pid	process
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 620 wrote to memory of 2632	620	powershell.exe	cmd.exe
PID 620 wrote to memory of 2632	620	powershell.exe	cmd.exe
PID 620 wrote to memory of 2632	620	powershell.exe	cmd.exe
PID 620 wrote to memory of 2860	620	powershell.exe	wermgr.exe
PID 620 wrote to memory of 2860	620	powershell.exe	wermgr.exe
PID 620 wrote to memory of 2860	620	powershell.exe	wermgr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Pyrograph\Perikoner\Intermeasuring199\Skibshandlernes.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
2⤵
PID:2632

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "620" "1136"
2⤵
PID:2860

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259417117.txt

Filesize
1KB

MD5
642dd6ac427451ef6d3848c7d1b4c7f6

SHA1
9684428988cd9a68e401dfe627a0159153fc928a

SHA256
94430bcf35aba8d9a6f7d17c61540a4e6e9088ec1229586966457b5329426e40

SHA512
d646cb0af23f126a2d731e9cd3094df57010c6fda875ae0796eac88f9a8e053c0bdf991cb5384aea8f4ea71a4f1c463c57b796c954e3205241e664a2b6afa577

Download Submit
memory/620-13-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/620-14-0x000000001B270000-0x000000001B274000-memory.dmp

Filesize
16KB

Download
memory/620-7-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/620-8-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/620-9-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/620-10-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Filesize
9.6MB

Download
memory/620-5-0x0000000002560000-0x0000000002568000-memory.dmp

Filesize
32KB

Download
memory/620-4-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/620-11-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/620-6-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Filesize
9.6MB

Download
memory/620-18-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/620-17-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Filesize
9.6MB

Download
memory/2576-19-0x0000000004090000-0x0000000004091000-memory.dmp

Filesize
4KB

Download
memory/2576-20-0x0000000004090000-0x0000000004091000-memory.dmp

Filesize
4KB

Download
memory/2576-24-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads