Analysis
-
max time kernel
357s -
max time network
357s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 11:15
Static task
static1
Behavioral task
behavioral1
Sample
q.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
q.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
Pidginizing/Halvpunkt240/Forblack231/Otiatric/Ergs.ps1
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Pidginizing/Halvpunkt240/Forblack231/Otiatric/Ergs.ps1
Resource
win10v2004-20240419-en
General
-
Target
Pidginizing/Halvpunkt240/Forblack231/Otiatric/Ergs.ps1
-
Size
54KB
-
MD5
1c0b0b1677e6a0e8e41383703430a228
-
SHA1
3226cc511cb4ee3c4d8fc85f8309e769b588c59f
-
SHA256
056096bc668ccf068617f877b2d960d93fcc3f2bfcf6dc51e3e6ee1a5c83cdb8
-
SHA512
b8856417ec13d2be0b53d74ec4a3b22784b5fa6ae0b2fd5d3cb21863103d01526ab60de2432e0532fcb27c36bc39d69e8178b1a8cc08f05a95c6bf591b581902
-
SSDEEP
768:NVOb/moCyL71NiFKFbshVB/RKpgdNfg5o6hwWPbIQ4bGkr1iDoxSP8Wej0aQ0wJ+:NVGmoCyH1LbQB/R45Wa/9D+lIJPgj
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepid process 1304 powershell.exe 1304 powershell.exe 1304 powershell.exe 1304 powershell.exe 1304 powershell.exe 1304 powershell.exe 1304 powershell.exe 1304 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2168 explorer.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
powershell.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1304 powershell.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe Token: SeShutdownPrivilege 2168 explorer.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
Processes:
explorer.exepid process 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe -
Suspicious use of SendNotifyMessage 21 IoCs
Processes:
explorer.exepid process 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
powershell.exedescription pid process target process PID 1304 wrote to memory of 1440 1304 powershell.exe cmd.exe PID 1304 wrote to memory of 1440 1304 powershell.exe cmd.exe PID 1304 wrote to memory of 1440 1304 powershell.exe cmd.exe PID 1304 wrote to memory of 2668 1304 powershell.exe wermgr.exe PID 1304 wrote to memory of 2668 1304 powershell.exe wermgr.exe PID 1304 wrote to memory of 2668 1304 powershell.exe wermgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Pidginizing\Halvpunkt240\Forblack231\Otiatric\Ergs.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"2⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1304" "1084"2⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259397766.txtFilesize
1KB
MD58287f93c23af29a0f9b5ecb797eb5bfd
SHA1966c4c8e018f421a6ed591a195543b0b6274113a
SHA25651edf408bf6f1cef5322527657cc7bb2871704971b0747c1722456d17d6d21d9
SHA5124a6f2dae020f7602fa0c344fe9e878945b163a7871fa3fcc2cbfaafd584ee28cd35a8d843302d2ce42e49aa2eb8938eee657005beee6d24c026ec04ee8e274a1
-
memory/1304-4-0x000000001B6C0000-0x000000001B9A2000-memory.dmpFilesize
2.9MB
-
memory/1304-9-0x00000000028C0000-0x0000000002940000-memory.dmpFilesize
512KB
-
memory/1304-10-0x00000000028C0000-0x0000000002940000-memory.dmpFilesize
512KB
-
memory/1304-8-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmpFilesize
9.6MB
-
memory/1304-5-0x00000000027A0000-0x00000000027A8000-memory.dmpFilesize
32KB
-
memory/1304-7-0x00000000028C0000-0x0000000002940000-memory.dmpFilesize
512KB
-
memory/1304-11-0x00000000028C0000-0x0000000002940000-memory.dmpFilesize
512KB
-
memory/1304-13-0x00000000028C0000-0x0000000002940000-memory.dmpFilesize
512KB
-
memory/1304-14-0x0000000002C40000-0x0000000002C44000-memory.dmpFilesize
16KB
-
memory/1304-6-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmpFilesize
9.6MB
-
memory/1304-17-0x00000000028C0000-0x0000000002940000-memory.dmpFilesize
512KB
-
memory/1304-18-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmpFilesize
9.6MB
-
memory/2168-22-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB