Analysis
- max time kernel
141s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
23/04/2024, 09:38
General
- Target Доверенность Транзит Хоргос.exe
- Size 997KB
- Sample240423-ll3xhsfc27
- SHA256 3c38e7e9865c42daaa40c6bf50be3f319db865a28e6961ec669a7c12f414aa70
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Доверенность Транзит Хоргос.exe"C:\Users\Admin\AppData\Local\Temp\Доверенность Транзит Хоргос.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Okkerpotentiel=Get-Content 'C:\Users\Admin\AppData\Local\nervier\Estampede\sipunculacean\Koban\Korterevarende\Televrkerne\Slrendes\Joplin77.Nar';$tabelnavnet=$Okkerpotentiel.SubString(57389,3);.$tabelnavnet($Okkerpotentiel)"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 25963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2220 -ip 22201⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ybzxqu5s.knh.ps1
Joplin77.Nar
memory/884-76-0x000001CFD1150000-0x000001CFD1151000-memory.dmp
memory/884-75-0x000001CFD1040000-0x000001CFD1041000-memory.dmp
memory/884-74-0x000001CFD1040000-0x000001CFD1041000-memory.dmp
memory/884-72-0x000001CFD1010000-0x000001CFD1011000-memory.dmp
memory/884-56-0x000001CFC8CA0000-0x000001CFC8CB0000-memory.dmp
memory/884-40-0x000001CFC8BA0000-0x000001CFC8BB0000-memory.dmp
memory/2220-19-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/2220-30-0x0000000005C20000-0x0000000005F74000-memory.dmp
memory/2220-32-0x0000000006160000-0x00000000061AC000-memory.dmp
memory/2220-33-0x0000000007220000-0x00000000072B6000-memory.dmp
memory/2220-34-0x00000000065D0000-0x00000000065EA000-memory.dmp
memory/2220-35-0x0000000006630000-0x0000000006652000-memory.dmp
memory/2220-36-0x0000000007870000-0x0000000007E14000-memory.dmp
memory/2220-31-0x00000000060C0000-0x00000000060DE000-memory.dmp
memory/2220-38-0x00000000084A0000-0x0000000008B1A000-memory.dmp
memory/2220-39-0x0000000074B60000-0x0000000075310000-memory.dmp
memory/2220-29-0x0000000005BB0000-0x0000000005C16000-memory.dmp
memory/2220-15-0x0000000074B60000-0x0000000075310000-memory.dmp
memory/2220-18-0x00000000050F0000-0x0000000005112000-memory.dmp
memory/2220-17-0x0000000005340000-0x0000000005968000-memory.dmp
memory/2220-14-0x0000000002790000-0x00000000027C6000-memory.dmp
memory/2220-16-0x0000000004D00000-0x0000000004D10000-memory.dmp