Analysis
- max time kernel
73s - max time network
80s - platform
windows10-1703_x64 - resource
win10-20240611-en - resource tags
- submitted
10/07/2024, 21:52
General
- Target 24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe
- Size 883KB
- Sample240710-1rav9avakd
- SHA256 24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe"C:\Users\Admin\AppData\Local\Temp\24924df6e5f906dc670ba961f6988681536b9dc540d38c3ccbec44ddf3aa4eea.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden " $Hvorunder=cat 'C:\Users\Admin\AppData\Local\forfrdelige\begyndervanskelighederne\Styrbart.Udd32';$Ladet=$Hvorunder.substring(79396,3);.$Ladet($Hvorunder)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 27963⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yxfgwsmk.3kb.ps1
Styrbart.Udd32
memory/4608-25-0x0000000008610000-0x000000000865B000-memory.dmp
memory/4608-26-0x00000000083F0000-0x0000000008466000-memory.dmp
memory/4608-19-0x0000000007A30000-0x0000000007A96000-memory.dmp
memory/4608-20-0x0000000007AA0000-0x0000000007B06000-memory.dmp
memory/4608-21-0x0000000007D70000-0x00000000080C0000-memory.dmp
memory/4608-24-0x0000000008100000-0x000000000811C000-memory.dmp
memory/4608-15-0x00007FF9A8C80000-0x00007FF9A8E5B000-memory.dmp
memory/4608-18-0x0000000007990000-0x00000000079B2000-memory.dmp
memory/4608-17-0x0000000007330000-0x0000000007958000-memory.dmp
memory/4608-41-0x0000000009520000-0x00000000095B4000-memory.dmp
memory/4608-42-0x0000000009200000-0x000000000921A000-memory.dmp
memory/4608-43-0x0000000009270000-0x0000000009292000-memory.dmp
memory/4608-44-0x0000000009B10000-0x000000000A00E000-memory.dmp
memory/4608-16-0x0000000006C60000-0x0000000006C96000-memory.dmp
memory/4608-50-0x000000000A690000-0x000000000AD08000-memory.dmp