Overview

overview

8

Static

static

3

6b3990554a...02.exe

windows7-x64

8

6b3990554a...02.exe

windows10-2004-x64

8

Skifterammers.ps1

windows7-x64

8

Skifterammers.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    139s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Skifterammers.ps1

  • Size

    57KB

  • MD5

    9003b8c618556b66af0fc968095d8bba

  • SHA1

    33d8a69579e0bbc848f0f7e414b4a9ef846a57c6

  • SHA256

    9c2e0d7d7ebfef6a420673a5d0bf67ed30f881cf66d1b27ed85d997e1b11c1d9

  • SHA512

    f62a4e3166a34f45bba3e8c802781c0a3bd228931f14de5891b65bb227a28becd7ab2daaaa5d9fbc19bd53fba27c41a63589e8355aec79744bfe4872ea6dffe0

  • SSDEEP

    1536:c/MTrs4O2qGhqZ8BXtsiVWIn702PqUws+qfTk+5pRYrnI:ckM4O2G8dVWIo2PqUP+qfT9l

Score
8/10
executionpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Skifterammers.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:652
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1744
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2164
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3624
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5408 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4356
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3240
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3544
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:2564
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:5076
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:2388

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                Filesize

                471B

                MD5

                45654e26b54abaef678dbdb46a9eb535

                SHA1

                a23cc33fe546ee53bdb07589548d84c2101d6ab0

                SHA256

                329924597f143dd23c32377fbcbde16a057c28500ff47149dfc4768df5853030

                SHA512

                313a7c6066b6be2cad54272cab1931fdf6f42b68c3ee78fd06eb4f4574df788a2e9892be74bed3f6198aab652fa3dcf36ccfff9f777d62d3c1d51acd0cff7f9b

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                Filesize

                412B

                MD5

                57d70b567c5dc7da8485fea89f4ca849

                SHA1

                1fe8ff92c2a136c271cc61085b9e82040b4b7a8c

                SHA256

                b984c4596b01f4f6d0b6e96233f9c7ddc7e9ca6bdfec0553a9cbcfd65dd2613a

                SHA512

                6cc8621ee48bbc3a6a1823d135204c72b4e80dd566739f3f971fb239e0cfd29fbb8ad94b61dbfbf6dfc7e3190985f59d0c429a83c767b9cc0deb65104f4b95bc

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                Filesize

                2KB

                MD5

                33cd0a174e9579ae4c822dba166a5ba7

                SHA1

                a032907817867c470819840aa7d8b4b5cf1436e9

                SHA256

                d94d1eb0965306a322b25c5b830d61efd43cbe500181d2165b341ef5b9a7bf5c

                SHA512

                a444f05532215a54d8933e63053ab24286e92fcbdee4ae8d42698288fa787ea974cbda895bc97fe689070118d506bd521c746d7e207ca0ae52b3af722daaae43

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133609018467574032.txt
                Filesize

                74KB

                MD5

                80dffedad36ef4c303579f8c9be9dbd7

                SHA1

                792ca2a83d616ca82d973ece361ed9e95c95a0d8

                SHA256

                590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e

                SHA512

                826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xml
                Filesize

                96B

                MD5

                84209e171da10686915fe7efcd51552d

                SHA1

                6bf96e86a533a68eba4d703833de374e18ce6113

                SHA256

                04d6050009ea3c99cc718ad1c07c5d15268b459fcfb63fcb990bc9761738907b

                SHA512

                48d2524000911cfb68ef866dedac78ee430d79aa3f4b68399f645dc2066841e6962e11a3362cbcec46680357dcd3e58cfef9994450fed1d8af04df44f76b0dfd

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2efzs51i.vyw.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • memory/1744-19-0x0000000004470000-0x0000000004471000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2564-244-0x0000026EF5280000-0x0000026EF52A0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/2564-239-0x0000026EF4E70000-0x0000026EF4E90000-memory.dmp

                Filesize

                128KB

                Download

              • memory/2564-213-0x0000026EF4EB0000-0x0000026EF4ED0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/2564-207-0x0000026EF3D50000-0x0000026EF3E50000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/3624-20-0x000002315CA50000-0x000002315CB50000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/3624-25-0x000002395EBF0000-0x000002395EC10000-memory.dmp

                Filesize

                128KB

                Download

              • memory/3624-42-0x000002395EBB0000-0x000002395EBD0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/3624-56-0x000002395EFC0000-0x000002395EFE0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/4444-0-0x00007FFFA5283000-0x00007FFFA5285000-memory.dmp

                Filesize

                8KB

                Download

              • memory/4444-197-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4444-13-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4444-12-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4444-179-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4444-11-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4444-163-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4444-134-0x00007FFFA5280000-0x00007FFFA5D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4444-133-0x00007FFFA5283000-0x00007FFFA5285000-memory.dmp

                Filesize

                8KB

                Download

              • memory/4444-10-0x000001C922160000-0x000001C922182000-memory.dmp

                Filesize

                136KB

                Download

              • memory/5076-206-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                Filesize

                4KB

                Download