Analysis

  • max time kernel
    133s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-04-2024 11:32

General

  • Target

    ravnemorens/Frsteinstanserne/Instantiations.ps1

  • Size

    54KB

  • MD5

    63d0c546b30964e943c2ac8fd5e236db

  • SHA1

    7d46713cb1d3cbfe25efcaf24369fb067d310920

  • SHA256

    eb26aa5b4ec7a1c0c0ad2be344c02a23f770815a40e84e5b1b5fe24c9b64edda

  • SHA512

    91399fec920e3be9526e1af39a632512c6c00cea3566a9ce43fdbadf813c5b2b830620bfc381747b195a4e2c52b8ef4d81295b484ea6ed925979a97b8cf6a1ed

  • SSDEEP

    768:stRSpMsDEBbiYzC9AUQg+Fj0VY6fgw8cl+ZzPhkrV439KaEJQkP5HF0GEFGRGI:uRUM0qbiCYYo3gnZzPKrOtKaiT8rE

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ravnemorens\Frsteinstanserne\Instantiations.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:2496
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "1644" "1084"
        2⤵
          PID:2520
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2704

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259404074.txt

        Filesize

        1KB

        MD5

        66d5620e1e925cc04b8d3628c3e24af9

        SHA1

        e91fdd258d2fd4d9a27604dcc2f69c4d76a65ecb

        SHA256

        5eaa6cf995416132cbacf92f56c7b2a1a02589bb1bef3c172a3fd387bdd8dfa6

        SHA512

        071116b03a99483afbb2d82bf2398f4763ff3ff743a21881ac55428bdbfff48f0ff6f77e7965a640b98b17be9f45ce5e3a681c88b1a05de38ea6b201f7cc09dc

      • memory/1644-13-0x0000000002B30000-0x0000000002BB0000-memory.dmp

        Filesize

        512KB

      • memory/1644-15-0x0000000002BB0000-0x0000000002BB4000-memory.dmp

        Filesize

        16KB

      • memory/1644-8-0x0000000002B30000-0x0000000002BB0000-memory.dmp

        Filesize

        512KB

      • memory/1644-6-0x00000000026E0000-0x00000000026E8000-memory.dmp

        Filesize

        32KB

      • memory/1644-9-0x0000000002B30000-0x0000000002BB0000-memory.dmp

        Filesize

        512KB

      • memory/1644-10-0x000007FEF5C30000-0x000007FEF65CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1644-7-0x0000000002B30000-0x0000000002BB0000-memory.dmp

        Filesize

        512KB

      • memory/1644-5-0x000007FEF5C30000-0x000007FEF65CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1644-11-0x0000000002B30000-0x0000000002BB0000-memory.dmp

        Filesize

        512KB

      • memory/1644-4-0x000000001B770000-0x000000001BA52000-memory.dmp

        Filesize

        2.9MB

      • memory/1644-17-0x000007FEF5C30000-0x000007FEF65CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1644-18-0x0000000002B30000-0x0000000002BB0000-memory.dmp

        Filesize

        512KB

      • memory/2704-19-0x0000000004200000-0x0000000004201000-memory.dmp

        Filesize

        4KB

      • memory/2704-20-0x0000000004200000-0x0000000004201000-memory.dmp

        Filesize

        4KB

      • memory/2704-24-0x0000000002B40000-0x0000000002B50000-memory.dmp

        Filesize

        64KB