Overview

overview

10

Static

static

1

DHL_M-0025...77.exe

windows7-x64

10

DHL_M-0025...77.exe

windows10-2004-x64

5

Forthtelle...ne.ps1

windows7-x64

8

Forthtelle...ne.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    133s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    29/04/2024, 09:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Forthteller/Fibrillationen52/Nonveracity/Kreolerne.ps1

  • Size

    57KB

  • MD5

    cef01801545d5b91580cd6a4a9273144

  • SHA1

    4ba951133e407bd0d6b0447d216528200aff68b9

  • SHA256

    f0f42ea894ea592f55fd42f05df638a1c0eb54f966671817ba67ac78d6da3345

  • SHA512

    57a39ee84f50065923d8441539da07a6ee49cc9e75e32d4f5b293c7d5a40b5f0cdf9b2e63fa29fbb279c86ad800ff4e8b72ed524d849e0ca423e61d3d9e0ebca

  • SSDEEP

    1536:L/LU8NrMkeSHgeclYZTQgE8fxuRkZFT1Y3a0cF:7LjrP4eSNBUYK7

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Forthteller\Fibrillationen52\Nonveracity\Kreolerne.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
      2⤵
        PID:2088
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "3000" "1088"
        2⤵
          PID:2080
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2616

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259395649.txt
        Filesize

        1KB

        MD5

        ed80d67bd7eea64b7d9311f1b5cb2633

        SHA1

        6121829544a061109dbcb3e459effd152bdddd65

        SHA256

        d02f9342b08cc1816a0e221c12e8663a9c9494910768dbdf95415ec61257b0c1

        SHA512

        67e1ac94d54d930ed1d241d33a0a3fe84964cb2dbada34fb5e5b77f30765ad471b8bedb362c2489cd3e46f0f775fb75a182e2aefd738b2eb826ab7436f8c6e34

        Download Submit

      • memory/2616-21-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3000-10-0x0000000002AC0000-0x0000000002B40000-memory.dmp

        Filesize

        512KB

        Download

      • memory/3000-4-0x000000001B4E0000-0x000000001B7C2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/3000-9-0x0000000002AC0000-0x0000000002B40000-memory.dmp

        Filesize

        512KB

        Download

      • memory/3000-8-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/3000-6-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/3000-12-0x0000000002AC0000-0x0000000002B40000-memory.dmp

        Filesize

        512KB

        Download

      • memory/3000-15-0x0000000002C50000-0x0000000002C54000-memory.dmp

        Filesize

        16KB

        Download

      • memory/3000-7-0x0000000002AC0000-0x0000000002B40000-memory.dmp

        Filesize

        512KB

        Download

      • memory/3000-16-0x0000000002AC0000-0x0000000002B40000-memory.dmp

        Filesize

        512KB

        Download

      • memory/3000-17-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/3000-5-0x0000000002390000-0x0000000002398000-memory.dmp

        Filesize

        32KB

        Download