Analysis
- max time kernel
137s - max time network
201s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
- submitted
10/07/2024, 21:52
General
- Target 24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe
- Size 883KB
- Sample240710-1q75csvaka
- SHA256 24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe"C:\Users\Admin\AppData\Local\Temp\24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden " $Hvorunder=cat 'C:\Users\Admin\AppData\Local\forfrdelige\begyndervanskelighederne\Styrbart.Udd32';$Ladet=$Hvorunder.substring(79396,3);.$Ladet($Hvorunder)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 25403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2432 -ip 24321⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_dvlqq5tb.klo.ps1
Styrbart.Udd32
memory/2432-28-0x0000000005A80000-0x0000000005DD7000-memory.dmp
memory/2432-29-0x0000000005EF0000-0x0000000005F0E000-memory.dmp
memory/2432-17-0x0000000005790000-0x00000000057B2000-memory.dmp
memory/2432-18-0x0000000005830000-0x0000000005896000-memory.dmp
memory/2432-19-0x00000000058A0000-0x0000000005906000-memory.dmp
memory/2432-15-0x0000000074320000-0x0000000074AD1000-memory.dmp
memory/2432-13-0x000000007432E000-0x000000007432F000-memory.dmp
memory/2432-16-0x0000000005130000-0x000000000575A000-memory.dmp
memory/2432-30-0x0000000005FA0000-0x0000000005FEC000-memory.dmp
memory/2432-31-0x0000000006FB0000-0x0000000007046000-memory.dmp
memory/2432-32-0x00000000063F0000-0x000000000640A000-memory.dmp
memory/2432-33-0x0000000006450000-0x0000000006472000-memory.dmp
memory/2432-34-0x0000000007600000-0x0000000007BA6000-memory.dmp
memory/2432-14-0x0000000004A50000-0x0000000004A86000-memory.dmp
memory/2432-36-0x0000000008230000-0x00000000088AA000-memory.dmp
memory/2432-38-0x0000000074320000-0x0000000074AD1000-memory.dmp