Analysis
-
max time kernel
132s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:39
Static task
static1
Behavioral task
behavioral1
Sample
74e64ac4e30e760332d456eb22f9c287a378653566cf4eac6278c4576c2d5cf9.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
74e64ac4e30e760332d456eb22f9c287a378653566cf4eac6278c4576c2d5cf9.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Stningsstrukturers.ps1
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Stningsstrukturers.ps1
Resource
win10v2004-20240426-en
General
-
Target
Stningsstrukturers.ps1
-
Size
58KB
-
MD5
dd200d8c3c09458738a4ee7d421a891b
-
SHA1
5821db55a8a2e95c67411c18893530d9c3cd47c6
-
SHA256
0e5ad13c4627a6fcb258cbcf2e67bde5ac0f66b8e85291ba05dacc5021eeb4df
-
SHA512
a2faef0cb547f0ee91ca5b45893300fc18943d1389f593bf2b58f557d8e85f7346e55be8a592c87e6e32dc98f9d568a05e59cc7d93b9288391c0465b6a68f39d
-
SSDEEP
1536:sWQH2/5I3Msf3ZYyEkBsrTX+SKmiXY81ruyMmWKYgZVYJ:sWi65tOJ7EkW+SCDrZ9Ycs
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepid process 2820 powershell.exe 2820 powershell.exe 2820 powershell.exe 2820 powershell.exe 2820 powershell.exe 2820 powershell.exe 2820 powershell.exe 2820 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2568 explorer.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
powershell.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2820 powershell.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe Token: SeShutdownPrivilege 2568 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
explorer.exepid process 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe -
Suspicious use of SendNotifyMessage 16 IoCs
Processes:
explorer.exepid process 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe 2568 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
powershell.exedescription pid process target process PID 2820 wrote to memory of 3028 2820 powershell.exe cmd.exe PID 2820 wrote to memory of 3028 2820 powershell.exe cmd.exe PID 2820 wrote to memory of 3028 2820 powershell.exe cmd.exe PID 2820 wrote to memory of 2648 2820 powershell.exe wermgr.exe PID 2820 wrote to memory of 2648 2820 powershell.exe wermgr.exe PID 2820 wrote to memory of 2648 2820 powershell.exe wermgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Stningsstrukturers.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2820" "1088"2⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259399366.txtFilesize
1KB
MD58968286a68c79beffdc690dc95142f79
SHA15f113825e939170e38ae6c24a856dbf26ce25a90
SHA2563360f26000a62d68d69110f047b09e3b2b80bad6dc78371bf1fec80c6baf0b38
SHA512713bc32c24b14a3400f917e4a8ddc422a108afb99a6d2e13b3a3ba6b78d89694b02565bf11e69f05a078c22477ba3c6078e150917f46a4beb89e138af8644647
-
memory/2568-20-0x0000000002110000-0x0000000002120000-memory.dmpFilesize
64KB
-
memory/2820-4-0x000007FEF627E000-0x000007FEF627F000-memory.dmpFilesize
4KB
-
memory/2820-5-0x000000001B530000-0x000000001B812000-memory.dmpFilesize
2.9MB
-
memory/2820-6-0x0000000002390000-0x0000000002398000-memory.dmpFilesize
32KB
-
memory/2820-7-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2820-8-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2820-9-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2820-10-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2820-11-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2820-13-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2820-16-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB