Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
17/07/2024, 15:14
General
- Target Richiesta Preventivo (ISGB) 7788EU - 0605ITA·pdf.exe
- Size 549KB
- Sample240717-sma2fswekm
- SHA256 c293bf33914dcab819681869283b39b23b45fb608d42fa3a26562d301eab3746
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Richiesta Preventivo (ISGB) 7788EU - 0605ITA·pdf.exe"C:\Users\Admin\AppData\Local\Temp\Richiesta Preventivo (ISGB) 7788EU - 0605ITA·pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Nervures=Get-Content 'C:\Users\Admin\AppData\Local\Bagtes\zygomata.Coo';$Omfangsbedmmelses64=$Nervures.SubString(24976,3);.$Omfangsbedmmelses64($Nervures)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 22203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1308 -ip 13081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
zygomata.Coo
__PSScriptPolicyTest_ym3dxgzd.djs.ps1
memory/1308-19-0x0000000005700000-0x0000000005766000-memory.dmp
memory/1308-27-0x0000000005E40000-0x0000000005E8C000-memory.dmp
memory/1308-12-0x00000000739A0000-0x0000000074150000-memory.dmp
memory/1308-13-0x0000000004EF0000-0x0000000004F12000-memory.dmp
memory/1308-10-0x00000000739A0000-0x0000000074150000-memory.dmp
memory/1308-20-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/1308-8-0x00000000739AE000-0x00000000739AF000-memory.dmp
memory/1308-25-0x00000000057E0000-0x0000000005B34000-memory.dmp
memory/1308-26-0x0000000005DB0000-0x0000000005DCE000-memory.dmp
memory/1308-11-0x0000000004F60000-0x0000000005588000-memory.dmp
memory/1308-28-0x0000000006D50000-0x0000000006DE6000-memory.dmp
memory/1308-30-0x0000000006320000-0x0000000006342000-memory.dmp
memory/1308-29-0x00000000062D0000-0x00000000062EA000-memory.dmp
memory/1308-31-0x00000000073A0000-0x0000000007944000-memory.dmp
memory/1308-9-0x00000000047F0000-0x0000000004826000-memory.dmp
memory/1308-33-0x0000000007FD0000-0x000000000864A000-memory.dmp
memory/1308-35-0x00000000739A0000-0x0000000074150000-memory.dmp