Overview

overview

10

Static

static

3

39e37a6736...8d.exe

windows7-x64

10

39e37a6736...8d.exe

windows10-2004-x64

6

unvolubly/...ng.ps1

windows7-x64

8

unvolubly/...ng.ps1

windows10-2004-x64

Analysis

  • max time kernel
    9s
  • max time network
    26s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/04/2024, 01:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    unvolubly/Langtrkkendes/Pelletising.ps1
  • Size 56KB
  • Sample240427-bpmdtsfh82
  • SHA256 de1fc8dc64b49c5ae8c2c9c45e7dd4d2aa154f845e99a8e8fa08b5abf23d38a7
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\unvolubly\Langtrkkendes\Pelletising.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
      2⤵
        PID:1056
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4472
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2152
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4904
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:528
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:940
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3340
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4032
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3424
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2260
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3336
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4400
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3836

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                            • Size 2KB
                            • SHA256 ba543ffec615e89384255ee3850b685c1fbf2a7db260ea66ce629c709adc2748
                            • MD5 SHA1 SHA512
                            Submit Download

                            AppCache133586543716823563.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586543716823563.txt
                            • Size 75KB
                            • SHA256 0792b6ce23ecab01dcc88e8fe286355f09b4fcc4708797a42574181a44ce1356
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            microsoft.windows[1].xml
                            • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3IAR76WG\microsoft.windows[1].xml
                            • Size 97B
                            • SHA256 3ef6aaac74887baac8772d19e979edda27ef2dd122335eebbf4898208f69cdaf
                            • MD5 SHA1 SHA512
                            Submit Download

                            __PSScriptPolicyTest_2yzphab4.kyt.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2yzphab4.kyt.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512
                            Submit Download

                            memory/940-23-0x0000000004210000-0x0000000004211000-memory.dmp
                            Download

                            memory/3336-193-0x0000012BB65A0000-0x0000012BB65C0000-memory.dmp
                            Download

                            memory/3336-206-0x0000012BB6BB0000-0x0000012BB6BD0000-memory.dmp
                            Download

                            memory/3336-184-0x0000012BB65E0000-0x0000012BB6600000-memory.dmp
                            Download

                            memory/3336-180-0x0000012BB5700000-0x0000012BB5800000-memory.dmp
                            Download

                            memory/3336-179-0x0000012BB5700000-0x0000012BB5800000-memory.dmp
                            Download

                            memory/3424-178-0x00000000042C0000-0x00000000042C1000-memory.dmp
                            Download

                            memory/4032-47-0x000001DC058A0000-0x000001DC058C0000-memory.dmp
                            Download

                            memory/4032-24-0x000001DC04500000-0x000001DC04600000-memory.dmp
                            Download

                            memory/4032-34-0x000001DC05290000-0x000001DC052B0000-memory.dmp
                            Download

                            memory/4032-29-0x000001DC052D0000-0x000001DC052F0000-memory.dmp
                            Download

                            memory/4916-18-0x00007FFAC82C0000-0x00007FFAC8D81000-memory.dmp
                            Download

                            memory/4916-17-0x000001C6564D0000-0x000001C6564D4000-memory.dmp
                            Download

                            memory/4916-16-0x000001C6557C0000-0x000001C6557D0000-memory.dmp
                            Download

                            memory/4916-14-0x000001C6557C0000-0x000001C6557D0000-memory.dmp
                            Download

                            memory/4916-13-0x000001C6557C0000-0x000001C6557D0000-memory.dmp
                            Download

                            memory/4916-11-0x000001C6557C0000-0x000001C6557D0000-memory.dmp
                            Download

                            memory/4916-12-0x000001C6557C0000-0x000001C6557D0000-memory.dmp
                            Download

                            memory/4916-10-0x00007FFAC82C0000-0x00007FFAC8D81000-memory.dmp
                            Download

                            memory/4916-0-0x000001C655790000-0x000001C6557B2000-memory.dmp
                            Download