1de20ab31a930a9f60a323ad35c4a0d670fc457cee78357d099784487bd8c9eb

General

Target

BPN__S-I03810366200624-820240628503036_202407010849535435_20240702135021·pdf.exe
Size

913KB
MD5

811a6608bd141b5c41cceaa9d1e7ee52
SHA1

63ee2d9a226ada53731204f906f5030cb6a28076
SHA256

1de20ab31a930a9f60a323ad35c4a0d670fc457cee78357d099784487bd8c9eb
SHA512

a27becb13d18fa4eb4c634ba2fb780505badd210fa380951948da1c9e56471649773786a2c0f35f889aa19981043f03375b10477b4b7b1fe10461dcedd8ca6cb
SSDEEP

12288:fBfOreq6OBi6FVd5cw6HETDVVKmuqCsV2qpqfyl0fGXJ9BqNJowksVz:lOreq6O9FRc2xVS5WEO0fG5vq7H

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1600	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	1600	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1600	3524	BPN__S-I03810366200624-820240628503036_202407010849535435_20240702135021·pdf.exe	92
PID 3524 wrote to memory of 1600	3524	BPN__S-I03810366200624-820240628503036_202407010849535435_20240702135021·pdf.exe	92
PID 3524 wrote to memory of 1600	3524	BPN__S-I03810366200624-820240628503036_202407010849535435_20240702135021·pdf.exe	92

C:\Users\Admin\AppData\Local\Temp\BPN__S-I03810366200624-820240628503036_202407010849535435_20240702135021·pdf.exe
"C:\Users\Admin\AppData\Local\Temp\BPN__S-I03810366200624-820240628503036_202407010849535435_20240702135021·pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$unterraced=Get-Content 'C:\Users\Admin\AppData\Local\twinsomeness\Pissoirers\Spirochete204.Myc';$Lagerekspedient=$unterraced.SubString(66375,3);.$Lagerekspedient($unterraced)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 2192
    3⤵
    - Program crash
    PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1600 -ip 1600
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z4r4tqcu.1lw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\twinsomeness\Pissoirers\Spirochete204.Myc

Filesize
69KB

MD5
20aa894e99916487d81dbe300b79fc2e

SHA1
adc74679240e54c6c18bb8aecfebdd0be6c83ba2

SHA256
0b52c1fa9332130ff96449b7b0449c15f46e707029232e6b73933ba39195e723

SHA512
cf2fbc0a23487b5eecbd3320981a7606b1725239ebf06d4059850dc3f1d444d6bb4e38c4e5e3bd59d0b5a95d73e3aeccc30290682543d3735fdca8dff81e4593

Download Submit
memory/1600-13-0x0000000073DA0000-0x0000000074550000-memory.dmp

Filesize
7.7MB

Download
memory/1600-28-0x00000000065B0000-0x00000000065FC000-memory.dmp

Filesize
304KB

Download
memory/1600-9-0x0000000073DAE000-0x0000000073DAF000-memory.dmp

Filesize
4KB

Download
memory/1600-14-0x0000000005C00000-0x0000000005C22000-memory.dmp

Filesize
136KB

Download
memory/1600-15-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Filesize
408KB

Download
memory/1600-16-0x0000000005D10000-0x0000000005D76000-memory.dmp

Filesize
408KB

Download
memory/1600-11-0x00000000055D0000-0x0000000005BF8000-memory.dmp

Filesize
6.2MB

Download
memory/1600-26-0x0000000006040000-0x0000000006394000-memory.dmp

Filesize
3.3MB

Download
memory/1600-27-0x0000000006510000-0x000000000652E000-memory.dmp

Filesize
120KB

Download
memory/1600-12-0x0000000073DA0000-0x0000000074550000-memory.dmp

Filesize
7.7MB

Download
memory/1600-29-0x0000000007570000-0x0000000007606000-memory.dmp

Filesize
600KB

Download
memory/1600-30-0x0000000006A00000-0x0000000006A1A000-memory.dmp

Filesize
104KB

Download
memory/1600-31-0x0000000006A70000-0x0000000006A92000-memory.dmp

Filesize
136KB

Download
memory/1600-32-0x0000000007BC0000-0x0000000008164000-memory.dmp

Filesize
5.6MB

Download
memory/1600-10-0x0000000004F60000-0x0000000004F96000-memory.dmp

Filesize
216KB

Download
memory/1600-34-0x00000000087F0000-0x0000000008E6A000-memory.dmp

Filesize
6.5MB

Download
memory/1600-36-0x0000000073DA0000-0x0000000074550000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing