81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7

General

Target

81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe
Size

852KB
MD5

9e40837aaacfeed4906aa0570ec315ec
SHA1

0bd44e5a499972bb3c6d7067d8078c3e62f96239
SHA256

81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7
SHA512

cb82f1d234efd8812dd8a5309784887b1a712416e0c328028761d3902b77d9a525e8f1777d4d4b54754edce533d329c6894c214df391c66fa847ecae841f886d
SSDEEP

12288:Kt7ExDo//OtX1lxawkeVCGmQzVuoLZJYiwQwxOiLKa/7G7N/xneIBrCFrJLzQc+b:eYDoeMwkejuoLDY/xPJcJlIF1Y

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2748	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Anraabelsens\Hyposternal.udk	81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2748	powershell.exe
2584	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2748 set thread context of 2584	2748	powershell.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2748	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2748	2624	81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe	30
PID 2624 wrote to memory of 2748	2624	81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe	30
PID 2624 wrote to memory of 2748	2624	81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe	30
PID 2624 wrote to memory of 2748	2624	81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe	30
PID 2748 wrote to memory of 2584	2748	powershell.exe	33
PID 2748 wrote to memory of 2584	2748	powershell.exe	33
PID 2748 wrote to memory of 2584	2748	powershell.exe	33
PID 2748 wrote to memory of 2584	2748	powershell.exe	33
PID 2748 wrote to memory of 2584	2748	powershell.exe	33
PID 2748 wrote to memory of 2584	2748	powershell.exe	33

C:\Users\Admin\AppData\Local\Temp\81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe
"C:\Users\Admin\AppData\Local\Temp\81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Smigenes=Get-Content 'C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Erhvervshmmets.Luc';$Garnered=$Smigenes.SubString(54970,3);.$Garnered($Smigenes) "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Affaldsbekendtgrelsen.Udp

Filesize
344KB

MD5
39397b343b671777ca5c7dcf4d287d73

SHA1
00c8bbf8e53ea621e9017822f3d1ebe58b355ec8

SHA256
8e2b76430a4c0101c2e0803f9da335c5a8a0d4103537e6c238afb5a93218d147

SHA512
a74ba99e7fb211eb0ae780465f7426eda18e497edd3b1dad4230e38b2dbb43f1f100d2c0564e4ce6bbd866263a593e77da40b52ffda51276364b9b33a14f8bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Erhvervshmmets.Luc

Filesize
70KB

MD5
99f10986831f0b06d636f45aaa55b383

SHA1
a46d8b7b026279ca83dd7f742360ef603945ed6a

SHA256
f5a8eecb8cab9c13fc90e5dc3a2ce4f180562e4777ec42305984cb5d97e03cd6

SHA512
04be34c6e39c11d93e51adde823790f7ba3d1e7328ca01460a39f914e445a322e8d1f097914008d205ce73418929a31f51bfb167ecf6226abee96940150511c3

Download Submit
memory/2584-19-0x0000000000CE0000-0x0000000001D42000-memory.dmp

Filesize
16.4MB

Download
memory/2748-7-0x0000000073841000-0x0000000073842000-memory.dmp

Filesize
4KB

Download
memory/2748-8-0x0000000073840000-0x0000000073DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-9-0x0000000073840000-0x0000000073DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-11-0x0000000073840000-0x0000000073DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-10-0x0000000073840000-0x0000000073DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-14-0x0000000073840000-0x0000000073DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-16-0x0000000073840000-0x0000000073DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-17-0x0000000006710000-0x00000000084D4000-memory.dmp

Filesize
29.8MB

Download
memory/2748-18-0x0000000073840000-0x0000000073DEB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing