Analysis

  • max time kernel
    133s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-04-2024 12:53

General

  • Target

    Buffisternes.ps1

  • Size

    60KB

  • MD5

    536404b62f83ffc1c1ab96b8702ac936

  • SHA1

    e3fcddb4a59854532c9628fb842a89e44600d4df

  • SHA256

    2257be627271ea9c32361cfcdb142ccb3b807d841dbfc04c08356cd1d8336600

  • SHA512

    5e4f55571925250785b7674552960883841caf0ae0949a788d3afaf38494aab49f3838eb2f17a6138f4131ffd9f995a153d1676fc382734fde2b83d43d94663d

  • SSDEEP

    768:XRG7q21ttLI7+7VD+oVBbRSI2K4bdIhyjxmFlcikC5pV5tZNN8WUM00WjCi/IDeQ:XRG7q2bt0KJD+obmBIhSqLL3NvGbnt2x

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Buffisternes.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:2624
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "2452" "1124"
        2⤵
          PID:2372
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2388

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259397459.txt

        Filesize

        1KB

        MD5

        ba9822ad9551aa4f53b3389f6fbd28fc

        SHA1

        73b379c841368c06889df36c5cf012e730b2c3ed

        SHA256

        129659d28b930e4ff7fa3f361f9149923151fbf8af6ec0c3f3fbf18577f8f7a2

        SHA512

        e807df156a7eb40b620e1b97c93aaacc0807b18831422ed94389100ac93bd91917b1568ba233d0db11b02be556bf0480a76ab416147a56cb54e98a13c8b8245b

      • memory/2388-23-0x0000000003B50000-0x0000000003B60000-memory.dmp

        Filesize

        64KB

      • memory/2388-19-0x0000000004710000-0x0000000004711000-memory.dmp

        Filesize

        4KB

      • memory/2388-18-0x0000000004710000-0x0000000004711000-memory.dmp

        Filesize

        4KB

      • memory/2452-7-0x00000000029C0000-0x0000000002A40000-memory.dmp

        Filesize

        512KB

      • memory/2452-10-0x00000000029C0000-0x0000000002A40000-memory.dmp

        Filesize

        512KB

      • memory/2452-9-0x00000000029C0000-0x0000000002A40000-memory.dmp

        Filesize

        512KB

      • memory/2452-12-0x00000000029C0000-0x0000000002A40000-memory.dmp

        Filesize

        512KB

      • memory/2452-14-0x0000000002BB0000-0x0000000002BB4000-memory.dmp

        Filesize

        16KB

      • memory/2452-8-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

        Filesize

        9.6MB

      • memory/2452-16-0x00000000029C0000-0x0000000002A40000-memory.dmp

        Filesize

        512KB

      • memory/2452-17-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

        Filesize

        9.6MB

      • memory/2452-4-0x000000001B760000-0x000000001BA42000-memory.dmp

        Filesize

        2.9MB

      • memory/2452-6-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

        Filesize

        9.6MB

      • memory/2452-5-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

        Filesize

        32KB