Analysis
-
max time kernel
133s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21/04/2024, 01:00
General
-
Target
Kursusplans.ps1
-
Size
59KB
-
MD5
867b6e69eaf64d49c92a00efe2f3484a
-
SHA1
57e409c3c4ec17f05de4b6900300c6ffb22447c7
-
SHA256
554a9d36104f6fe2c57ebef379f96adb5205f4652780c0459db40e676f5efa1c
-
SHA512
3d075d6850562b2f68503e48f9349a50dcf65e69626b85b5312bf0bd6938b3b433cafb3ed4f885b392c4157b6997613ea551729a35028f5be1151ac3feda1856
-
SSDEEP
1536:oKohIDhrU/xqIsVWUQ7IQp0lYmDc+m4PsrHLc:oJhI5U/xKWLpwon4Ps7Lc
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Kursusplans.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1908" "1084"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5393006187cfc54d1845d51e69be19982
SHA1ec9bbc2750851b9d3bbd8a9755b27cb507bacfd0
SHA25617523d5745c5fde867346e1b826812ad1fa3c8faba8bebd63f9dd484d040f035
SHA5129f5bf6eb7544089964b0843b145e752fa06123c970297217c4c6c06f8219c46c6986e6e21c58f1d699c5e8514df18f7f50df691aa540ed1c14428180c0017553
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
16KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB