Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 15:45
Static task
static1
Behavioral task
behavioral1
Sample
PI_230524.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
PI_230524.exe
Resource
win10v2004-20240508-en
General
-
Target
PI_230524.exe
-
Size
531KB
-
MD5
fe3bcba4cdc4ae741ee54de500496669
-
SHA1
e27ac7c118efb35b85abf8dc4300a6291737dea2
-
SHA256
86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe
-
SHA512
d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8
-
SSDEEP
6144:+Y8i9d6ihOq761Mymf40IoBdLlNZ4DYvP+TV5lKiecmMlGvtClbUpEjoltWucv:8K6+L761MymflCYX+EixjlGHu8ltWuq
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4348 1916 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepid process 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1916 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
PI_230524.exepowershell.exedescription pid process target process PID 756 wrote to memory of 1916 756 PI_230524.exe powershell.exe PID 756 wrote to memory of 1916 756 PI_230524.exe powershell.exe PID 756 wrote to memory of 1916 756 PI_230524.exe powershell.exe PID 1916 wrote to memory of 3276 1916 powershell.exe cmd.exe PID 1916 wrote to memory of 3276 1916 powershell.exe cmd.exe PID 1916 wrote to memory of 3276 1916 powershell.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI_230524.exe"C:\Users\Admin\AppData\Local\Temp\PI_230524.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Treholdsskiftet=Get-Content 'C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.Pre';$Skiameter=$Treholdsskiftet.SubString(55621,3);.$Skiameter($Treholdsskiftet)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 25883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1916 -ip 19161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wev2arlj.jo1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.PreFilesize
54KB
MD522252e2ecc5fad588b2a1855271240d7
SHA116e3f7b4f36b0804f372e9dc199748eced0be25c
SHA256d82ec244a3f9172ac6eb88f87b46147b085b1ef3cd0b1787cb7029f5eeef74c0
SHA51298ca2f227d5e8e32a098f8c98c432f1693617196ca3dfd81404ff247a8e8254c631cc291965b0a8fb724798c98bc4dc65963d23c81ebbbd7762acb391b4361a0
-
memory/1916-25-0x00000000059A0000-0x0000000005A06000-memory.dmpFilesize
408KB
-
memory/1916-36-0x0000000006050000-0x000000000609C000-memory.dmpFilesize
304KB
-
memory/1916-21-0x0000000073970000-0x0000000074120000-memory.dmpFilesize
7.7MB
-
memory/1916-22-0x0000000005180000-0x00000000051A2000-memory.dmpFilesize
136KB
-
memory/1916-29-0x0000000005A10000-0x0000000005A76000-memory.dmpFilesize
408KB
-
memory/1916-19-0x0000000073970000-0x0000000074120000-memory.dmpFilesize
7.7MB
-
memory/1916-17-0x000000007397E000-0x000000007397F000-memory.dmpFilesize
4KB
-
memory/1916-34-0x0000000005B80000-0x0000000005ED4000-memory.dmpFilesize
3.3MB
-
memory/1916-35-0x0000000006000000-0x000000000601E000-memory.dmpFilesize
120KB
-
memory/1916-20-0x0000000005370000-0x0000000005998000-memory.dmpFilesize
6.2MB
-
memory/1916-37-0x0000000006FD0000-0x0000000007066000-memory.dmpFilesize
600KB
-
memory/1916-38-0x0000000006570000-0x000000000658A000-memory.dmpFilesize
104KB
-
memory/1916-39-0x0000000006590000-0x00000000065B2000-memory.dmpFilesize
136KB
-
memory/1916-40-0x0000000007620000-0x0000000007BC4000-memory.dmpFilesize
5.6MB
-
memory/1916-18-0x0000000002A30000-0x0000000002A66000-memory.dmpFilesize
216KB
-
memory/1916-42-0x0000000008250000-0x00000000088CA000-memory.dmpFilesize
6.5MB
-
memory/1916-44-0x0000000073970000-0x0000000074120000-memory.dmpFilesize
7.7MB