Analysis
-
max time kernel
44s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/06/2024, 07:13
Static task
static1
Behavioral task
behavioral1
Sample
meeting invitation.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
meeting invitation.ps1
Resource
win11-20240508-en
General
-
Target
meeting invitation.ps1
-
Size
141KB
-
MD5
1f7236d71cc27c840cce8527e661a534
-
SHA1
d7f5520047ac3847e8b540393cc6509afed5179c
-
SHA256
517ba2d7ccc734ae6d96809bae420555cae7ad1ff9c3df026ef54ec1986c6983
-
SHA512
ea7883854a86382257d3e9b9cf66747f75ac636c159e227ea12cf634e14c286d84edf752291426548e69c28b360217da700da43137aa54774f2e1a26649cc70e
-
SSDEEP
384:w4EhgXsRFpBjYishqgaqarBsBI92v1GOWPnQB+7WFpj:V7X6FpdYi7gaSa92sY6WFpj
Malware Config
Signatures
-
pid Process 4852 powershell.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4852 powershell.exe 4852 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4852 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 464 MiniSearchHost.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\meeting invitation.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize11KB
MD53569ff1aa5310102ef02c312ca4dbe9a
SHA14124b1e805d5c487bf86182d19ed22bed6cf44ac
SHA2563ce1168408eb889f65cd4d45c12c58842a4291356c835cfb1877d017b6768a9b
SHA512c966ebf69abce51aa4fbec1e53f43485786cbeb5fb6cea18eb3407b7d4c7a212a6843b69965de9f577c483c6139840d0f7fe56d69fc8c97e6b0884b75b7aed8d
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize11KB
MD5cd56e155edf53e5728c46b6c9eb9c413
SHA114b1b0f090803c9ee39797aed4af13dc7849566d
SHA25670a6cf268c013fb4d907bedc12af3e5f802f179f0cc8353c7b8227dde840d31a
SHA512a4ada455d44a89fd2baa505aa9266b70913967b839522ef5da8d7afd31af6662c3ad96ac3e3531d82a72be7d019c9d88f1ce391c5b5fa0e4422a634c51491165
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82