Overview

overview

10

Static

static

3

Специ...я.exe

windows7-x64

10

Специ...я.exe

windows10-2004-x64

Fellator/P...rt.ps1

windows7-x64

8

Fellator/P...rt.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    26s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2024 15:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fellator/Paletter/Lowbyte/Avanceringen157/Rekrt.ps1

  • Size

    56KB

  • MD5

    2354362f1cb0a39baef7da6969832048

  • SHA1

    ed2a3597370eea69ea017af285c99d1b60556a0c

  • SHA256

    f5129323c012e960d4b1a619a95757cc81675275e4c795883004c54da5ed3bb2

  • SHA512

    a09dbc69627bd42180fe9cf8fc7234798e30296de3a2b35a0c071e7507d9a63a5dc3f0873183a8bd93e929e05ea5d647323cf2905f4550cfb8cc5ee07353999a

  • SSDEEP

    1536:cNNoZXAoFiKJ3QQkAZAheVVkK95OhXOEFcKNmRAbUmptcI:cNWZJU+Y6MOVvWUKNsA4mgI

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Fellator\Paletter\Lowbyte\Avanceringen157\Rekrt.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:4936
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3284
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3448
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3832
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4232
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3436
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:860
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1508
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2212
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:5056
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4984
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4148
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4776
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4864
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3408

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4F70DE3A\microsoft.windows[1].xml
      Filesize

      97B

      MD5

      aac7d5913b8448593e8566d95788ced6

      SHA1

      e967e8d8ef9b46e250575b2e6e5590c6c6bab57e

      SHA256

      3d1dfdee76cf0d9c09c1f82000c6871c1f44a5a8128a6bb3bac326cc50bfdeda

      SHA512

      f4a13cf4fa6c4a78856097aa2a201b0a3d4b216dd2f8fe8a23175e9c2f5986f543dab59b99a915c5b741238bb4a21a2b39f842e0e324f50ffaefd87322fad1a8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yyoxwtja.ew3.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/860-42-0x0000000004200000-0x0000000004201000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2212-54-0x00000298B5E80000-0x00000298B5EA0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2212-52-0x00000298B5870000-0x00000298B5890000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2212-50-0x00000298B58B0000-0x00000298B58D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2440-17-0x00007FF8A1770000-0x00007FF8A2231000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2440-16-0x000001B080B60000-0x000001B080B64000-memory.dmp

      Filesize

      16KB

      Download

    • memory/2440-15-0x000001B0FFA50000-0x000001B0FFA60000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2440-9-0x000001B0FFC00000-0x000001B0FFC22000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2440-13-0x000001B0FFA50000-0x000001B0FFA60000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2440-12-0x000001B0FFA50000-0x000001B0FFA60000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2440-11-0x000001B0FFA50000-0x000001B0FFA60000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2440-10-0x00007FF8A1770000-0x00007FF8A2231000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3408-97-0x000001BC43D90000-0x000001BC43DB0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3408-95-0x000001BC43980000-0x000001BC439A0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3408-93-0x000001BC439C0000-0x000001BC439E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3436-33-0x00000284F68D0000-0x00000284F68F0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3436-29-0x00000284F6480000-0x00000284F64A0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3436-27-0x00000284F64C0000-0x00000284F64E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3832-21-0x0000000004960000-0x0000000004961000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4148-70-0x000001C6E7EA0000-0x000001C6E7EC0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4148-72-0x000001C6E7E60000-0x000001C6E7E80000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4148-74-0x000001C6E8480000-0x000001C6E84A0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4776-85-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5056-62-0x0000000004040000-0x0000000004041000-memory.dmp

      Filesize

      4KB

      Download