b555b98abe8eb8f9e9f240fdb22070df16680e8864a6d93549a8288f57bff5c7

Analysis

max time kernel
132s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Michelines.ps1
Size

56KB
MD5

82340892cba1f6e4faaa080bb634cf9c
SHA1

56b029cbcada747897e9beff7c8f1013b8c9b6ce
SHA256

a03bb54517df231824d324ad20b79094efef9af20eff855e30a6f459bcc43912
SHA512

dfea5297d9aef9004af38f8604e74313f99d477199e797dbeec5367ec3e6c0000a4c62eeab54425deee14de5b1adb224f09956a10619cf03b821b2b91b84f5c7
SSDEEP

1536:aY1v3JTUB3Z1un5G97KwaJx8NIodV4kIj+1S78:auBUEnY7za0NIMa+k8

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exe

pid process

952 powershell.exe
952 powershell.exe
952 powershell.exe
952 powershell.exe
952 powershell.exe
952 powershell.exe
952 powershell.exe
952 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2588 explorer.exe

pid	process
952	powershell.exe
952	powershell.exe
952	powershell.exe
952	powershell.exe
952	powershell.exe
952	powershell.exe
952	powershell.exe
952	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powershell.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	952	powershell.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe
Token: SeShutdownPrivilege	2588	explorer.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

explorer.exe

pid	process
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

Processes:

explorer.exe

pid	process
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe
2588	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 952 wrote to memory of 2536	952	powershell.exe	cmd.exe
PID 952 wrote to memory of 2536	952	powershell.exe	cmd.exe
PID 952 wrote to memory of 2536	952	powershell.exe	cmd.exe
PID 952 wrote to memory of 2660	952	powershell.exe	wermgr.exe
PID 952 wrote to memory of 2660	952	powershell.exe	wermgr.exe
PID 952 wrote to memory of 2660	952	powershell.exe	wermgr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Michelines.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
  2⤵
  PID:2536
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "952" "1084"
  2⤵
  PID:2660

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259396527.txt

Filesize
1KB

MD5
ebcd5e7e1a03705f9bb6dc7429c1d3d0

SHA1
93477b2dcfd702055ae6eb06c3ffc45fc09d2dac

SHA256
c6f07d76953644eeaf9dd1e04fb1da8d15bb765fb5021114ec1ca9f892fc2835

SHA512
b3ff2e25d55e0bfffa3141bb1b10af9546ea6d1e43a1e017972570be3d7bec816ce20ade97b63dffaecf571a171770cfab73587031df3c195f0fbb456e39fa9d

Download Submit
memory/952-13-0x0000000002E30000-0x0000000002EB0000-memory.dmp

Filesize
512KB

Download
memory/952-17-0x0000000002E30000-0x0000000002EB0000-memory.dmp

Filesize
512KB

Download
memory/952-5-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/952-8-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/952-9-0x0000000002E30000-0x0000000002EB0000-memory.dmp

Filesize
512KB

Download
memory/952-11-0x0000000002E30000-0x0000000002EB0000-memory.dmp

Filesize
512KB

Download
memory/952-7-0x0000000002E30000-0x0000000002EB0000-memory.dmp

Filesize
512KB

Download
memory/952-4-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/952-10-0x0000000002E30000-0x0000000002EB0000-memory.dmp

Filesize
512KB

Download
memory/952-6-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/952-18-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/952-15-0x0000000002BC0000-0x0000000002BC4000-memory.dmp

Filesize
16KB

Download
memory/2588-19-0x00000000043A0000-0x00000000043A1000-memory.dmp

Filesize
4KB

Download
memory/2588-20-0x00000000043A0000-0x00000000043A1000-memory.dmp

Filesize
4KB

Download
memory/2588-24-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download