Resubmissions
09-07-2024 08:24
240709-kayyraxdja 1009-07-2024 08:05
240709-jy18catfpk 809-07-2024 08:03
240709-jxzywstfln 1009-07-2024 07:56
240709-js4raawenc 1009-07-2024 07:46
240709-jl1faatarm 1009-07-2024 07:38
240709-jgh1fawajg 8Analysis
-
max time kernel
190s -
max time network
196s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
09-07-2024 07:38
Static task
static1
Behavioral task
behavioral1
Sample
batterie daahindenes.exe
Resource
win10-20240611-en
General
-
Target
batterie daahindenes.exe
-
Size
398KB
-
MD5
b1c35e78f5d588430c4f534479def9f2
-
SHA1
f787dd3327ca04361935f74867f76f16821db99f
-
SHA256
4412e46cdfffa346ea1d4e07b30077ccaa09fe1cbbe6f9965df193f2e063f4b7
-
SHA512
5f78e6794ae313f5ca96c33fe0ecf0c882a18a93caa54bf92823ac42c5c753b6a98d4c77618de2b62cbc9d24e6e500272e4ffa7b25afff20b7e8349fc278a66c
-
SSDEEP
12288:9GkmNVhJhqnfP30YhNia+nv4tQD3W/P19QY:9GkmPh7qfPrsQeD3W/bd
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 7384 4892 WerFault.exe powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
powershell.exetaskmgr.exepid process 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 4892 powershell.exe Token: SeDebugPrivilege 7724 taskmgr.exe Token: SeSystemProfilePrivilege 7724 taskmgr.exe Token: SeCreateGlobalPrivilege 7724 taskmgr.exe Token: 33 7724 taskmgr.exe Token: SeIncBasePriorityPrivilege 7724 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe 7724 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
batterie daahindenes.exedescription pid process target process PID 4220 wrote to memory of 4892 4220 batterie daahindenes.exe powershell.exe PID 4220 wrote to memory of 4892 4220 batterie daahindenes.exe powershell.exe PID 4220 wrote to memory of 4892 4220 batterie daahindenes.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\batterie daahindenes.exe"C:\Users\Admin\AppData\Local\Temp\batterie daahindenes.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Vangede=Get-Content 'C:\Users\Admin\AppData\Roaming\annekskirkers\dommedagens\nonmenial\Reexpression.Tid';$Spondylotomy=$Vangede.SubString(70479,3);.$Spondylotomy($Vangede)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 27483⤵
- Program crash
PID:7384
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:7504
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
68KB
MD5d89dac6d6bcfb431c31bdf7d21f48fbd
SHA12f55f2b77da6a9078c7bb90fd87b205c9c4cf3b9
SHA256ffeacf6c0a98133600a0f1de25732fb4b22b06af6921edd316e52a6d7837359b
SHA51276eb9025c18fd7661cb72d47c7eda57a45304594e5aea32fe73b1dd94ec9db81753726f83e6d9f82924c3b9295eef4725dbaa7d633963ac8e8e91b7444346070