Analysis
- max time kernel
142s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
24/07/2024, 06:52
General
- Target Apixaban - August 2024.XLS.exe
- Size 852KB
- Sample240724-hm4nnaweqf
- SHA256 eae5e1287cb5c85e19a44773df0e8ced0da00391d11df35931d7c96db9781dfb
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Apixaban - August 2024.XLS.exe"C:\Users\Admin\AppData\Local\Temp\Apixaban - August 2024.XLS.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Astmas=Get-Content 'C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Snigmorderne.Mat';$Formulvnr=$Astmas.SubString(2447,3);.$Formulvnr($Astmas) "2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 26283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 50161⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_clmuw2gx.uru.ps1
Snigmorderne.Mat
memory/5016-9-0x0000000073A40000-0x00000000741F0000-memory.dmp
memory/5016-24-0x00000000064E0000-0x000000000652C000-memory.dmp
memory/5016-5-0x0000000073A4E000-0x0000000073A4F000-memory.dmp
memory/5016-10-0x00000000054E0000-0x0000000005502000-memory.dmp
memory/5016-12-0x0000000005E30000-0x0000000005E96000-memory.dmp
memory/5016-11-0x0000000005DC0000-0x0000000005E26000-memory.dmp
memory/5016-8-0x0000000073A40000-0x00000000741F0000-memory.dmp
memory/5016-22-0x0000000005EA0000-0x00000000061F4000-memory.dmp
memory/5016-23-0x00000000064B0000-0x00000000064CE000-memory.dmp
memory/5016-7-0x0000000005560000-0x0000000005B88000-memory.dmp
memory/5016-25-0x0000000006A30000-0x0000000006AC6000-memory.dmp
memory/5016-26-0x00000000069E0000-0x00000000069FA000-memory.dmp
memory/5016-27-0x0000000007480000-0x00000000074A2000-memory.dmp
memory/5016-28-0x0000000007A60000-0x0000000008004000-memory.dmp
memory/5016-6-0x0000000002EE0000-0x0000000002F16000-memory.dmp
memory/5016-30-0x0000000008690000-0x0000000008D0A000-memory.dmp
memory/5016-32-0x0000000073A40000-0x00000000741F0000-memory.dmp