Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 02:10
Static task
static1
Behavioral task
behavioral1
Sample
efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Scrubbiest.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Scrubbiest.ps1
Resource
win10v2004-20240412-en
General
-
Target
efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe
-
Size
690KB
-
MD5
bf86a2ca1461479a33c704c80cef8a6b
-
SHA1
d1e328e1870c5c8b4cf9bf3af2188150c155a637
-
SHA256
efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d
-
SHA512
ab4ad977917361feb92122bff68d0bb3a2c8852a6afa78abded5353b2dc59deb8958738420af84e5f0e8630ea6d046e32ba089d25614373a263d173affed05cf
-
SSDEEP
12288:60oU0UEneHuDY7nCkEPaT24WxsTI8okD70a2ybmDIj8+uu3M6Je0:mxneHuDYukEPAWxsTILkDB247uu39d
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2804 3448 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exepid process 3448 powershell.exe 3448 powershell.exe 3448 powershell.exe 3448 powershell.exe 3448 powershell.exe 3448 powershell.exe 3448 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3448 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exepowershell.exedescription pid process target process PID 4708 wrote to memory of 3448 4708 efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe powershell.exe PID 4708 wrote to memory of 3448 4708 efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe powershell.exe PID 4708 wrote to memory of 3448 4708 efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe powershell.exe PID 3448 wrote to memory of 2652 3448 powershell.exe cmd.exe PID 3448 wrote to memory of 2652 3448 powershell.exe cmd.exe PID 3448 wrote to memory of 2652 3448 powershell.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe"C:\Users\Admin\AppData\Local\Temp\efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$vgtige=Get-Content 'C:\Users\Admin\AppData\Local\Temp\rumfangsformlers\mettemaries\Scrubbiest.Chy';$noncongealing=$vgtige.SubString(9350,3);.$noncongealing($vgtige)"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 25683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3448 -ip 34481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ojn4vrqy.bfa.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\rumfangsformlers\mettemaries\Scrubbiest.ChyFilesize
57KB
MD536f3eda8b46d735a96cb9165b92d06d3
SHA15b1a49b1eb273416216d37b658609bbef7476a7f
SHA2562b3fd293b418e5a6e53a9236a84e66b61e5d2831b19a0618b1fb3333ed8122fa
SHA512e280860d5d76bd7ebf97f02c4fb539d7349d616ac94dd2f6e3697a96a89afae4a904cca982863655d63fd8057c16201bc977b8f2929623a5940166b5e7180139
-
memory/3448-9-0x00000000058A0000-0x0000000005EC8000-memory.dmpFilesize
6.2MB
-
memory/3448-24-0x0000000006760000-0x00000000067AC000-memory.dmpFilesize
304KB
-
memory/3448-6-0x0000000074E80000-0x0000000075630000-memory.dmpFilesize
7.7MB
-
memory/3448-10-0x0000000005810000-0x0000000005832000-memory.dmpFilesize
136KB
-
memory/3448-11-0x0000000005F40000-0x0000000005FA6000-memory.dmpFilesize
408KB
-
memory/3448-12-0x00000000060A0000-0x0000000006106000-memory.dmpFilesize
408KB
-
memory/3448-8-0x0000000002D50000-0x0000000002D60000-memory.dmpFilesize
64KB
-
memory/3448-22-0x0000000006110000-0x0000000006464000-memory.dmpFilesize
3.3MB
-
memory/3448-23-0x00000000066B0000-0x00000000066CE000-memory.dmpFilesize
120KB
-
memory/3448-7-0x0000000002D50000-0x0000000002D60000-memory.dmpFilesize
64KB
-
memory/3448-25-0x0000000007890000-0x0000000007926000-memory.dmpFilesize
600KB
-
memory/3448-27-0x0000000006C20000-0x0000000006C42000-memory.dmpFilesize
136KB
-
memory/3448-26-0x0000000006BD0000-0x0000000006BEA000-memory.dmpFilesize
104KB
-
memory/3448-28-0x0000000007EE0000-0x0000000008484000-memory.dmpFilesize
5.6MB
-
memory/3448-5-0x00000000030F0000-0x0000000003126000-memory.dmpFilesize
216KB
-
memory/3448-30-0x0000000008B10000-0x000000000918A000-memory.dmpFilesize
6.5MB
-
memory/3448-31-0x0000000074E80000-0x0000000075630000-memory.dmpFilesize
7.7MB