Analysis
-
max time kernel
135s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-08-2024 18:40
General
-
Target
run.ps1
-
Size
1B
-
MD5
7215ee9c7d9dc229d2921a40e899ec5f
-
SHA1
b858cb282617fb0956d960215c8e84d1ccf909c6
-
SHA256
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
-
SHA512
f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 5 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresFilesize
2KB
MD594d4e71bbbbab32c6f8d8a1b8694a565
SHA10236c80fca5dd42bff9ab602c7ca502dd3dc16e0
SHA256e32d82f9b470d80a73951a3bd194b49a444c61ce27bf04734870437467e7a7eb
SHA5123fde7fd8c0b10a44d7e0b67429cce6276c94e918c79563a5129ce24f90366d30dd8d1b55de96261acd6142bc8e478633d2c358fe945a05d5c1b11dfb4636d5f8
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133671841910812780.txtFilesize
74KB
MD53cef2fbe41772d5aa87a416eac0b2d57
SHA11195972ebee178bfa0ad7542a9939749f06bf018
SHA25633e2fca7029f3a8b1fb6fd411e3497b60e9c1b997129c4e2ae1e79a8ddc72b45
SHA51244c30f3743f2fe08df6536b7baea7ea69fab7e6e3764534d6c5492f27f6116843bfe814f1eee6ff104df801e6e7c74eff4875c1b5dc00f0376328bbcc5fe03a5
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MP05IF81\microsoft.windows[1].xmlFilesize
96B
MD5188f8f76ad695de69c313c1113722ec5
SHA1acf66cf340e75c0997ab844f745ed139e05b5c1c
SHA256d926dfadf64142c9d6e871f8e3d4709e78b5e82e237fcde0680740eed9c82b5b
SHA51200eb7bda00afe8efe5b3f29460e2d92d173911f7deabb097d9995fb9af556371c4cecb473d328c8f9c7c85978fd560b1b9cec723805c44bd167ff59c3cf5bbf3
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sxxx02fz.qh0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/612-530-0x000002A648280000-0x000002A6482A0000-memory.dmpFilesize
128KB
-
memory/612-531-0x000002A648690000-0x000002A6486B0000-memory.dmpFilesize
128KB
-
memory/612-499-0x000002A6482C0000-0x000002A6482E0000-memory.dmpFilesize
128KB
-
memory/612-494-0x000002A647160000-0x000002A647260000-memory.dmpFilesize
1024KB
-
memory/612-496-0x000002A647160000-0x000002A647260000-memory.dmpFilesize
1024KB
-
memory/612-495-0x000002A647160000-0x000002A647260000-memory.dmpFilesize
1024KB
-
memory/964-641-0x00000000032D0000-0x00000000032D1000-memory.dmpFilesize
4KB
-
memory/1652-34-0x0000000003510000-0x0000000003511000-memory.dmpFilesize
4KB
-
memory/1956-26-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-25-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-23-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-27-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-16-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-22-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-24-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-18-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-17-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/1956-28-0x000002D00F0F0000-0x000002D00F0F1000-memory.dmpFilesize
4KB
-
memory/2124-194-0x0000000004410000-0x0000000004411000-memory.dmpFilesize
4KB
-
memory/2464-36-0x000001CE7A800000-0x000001CE7A900000-memory.dmpFilesize
1024KB
-
memory/2464-47-0x000001CE7B6B0000-0x000001CE7B6D0000-memory.dmpFilesize
128KB
-
memory/2464-41-0x000001CE7B6F0000-0x000001CE7B710000-memory.dmpFilesize
128KB
-
memory/2464-60-0x000001CE7BCC0000-0x000001CE7BCE0000-memory.dmpFilesize
128KB
-
memory/2464-37-0x000001CE7A800000-0x000001CE7A900000-memory.dmpFilesize
1024KB
-
memory/2636-492-0x0000000004730000-0x0000000004731000-memory.dmpFilesize
4KB
-
memory/3184-797-0x0000027396580000-0x00000273965A0000-memory.dmpFilesize
128KB
-
memory/3184-808-0x0000027396950000-0x0000027396970000-memory.dmpFilesize
128KB
-
memory/3184-800-0x0000027396540000-0x0000027396560000-memory.dmpFilesize
128KB
-
memory/3184-792-0x0000027395420000-0x0000027395520000-memory.dmpFilesize
1024KB
-
memory/3388-340-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/3560-790-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/3616-213-0x0000025E23330000-0x0000025E23350000-memory.dmpFilesize
128KB
-
memory/3616-223-0x0000025E23740000-0x0000025E23760000-memory.dmpFilesize
128KB
-
memory/3616-201-0x0000025E23370000-0x0000025E23390000-memory.dmpFilesize
128KB
-
memory/3616-197-0x0000025E22220000-0x0000025E22320000-memory.dmpFilesize
1024KB
-
memory/3616-198-0x0000025E22220000-0x0000025E22320000-memory.dmpFilesize
1024KB
-
memory/4020-344-0x0000029226500000-0x0000029226600000-memory.dmpFilesize
1024KB
-
memory/4020-379-0x0000029227A10000-0x0000029227A30000-memory.dmpFilesize
128KB
-
memory/4020-343-0x0000029226500000-0x0000029226600000-memory.dmpFilesize
1024KB
-
memory/4020-347-0x0000029227640000-0x0000029227660000-memory.dmpFilesize
128KB
-
memory/4020-360-0x0000029227600000-0x0000029227620000-memory.dmpFilesize
128KB
-
memory/4088-679-0x0000028CDE900000-0x0000028CDE920000-memory.dmpFilesize
128KB
-
memory/4088-656-0x0000028CDE500000-0x0000028CDE520000-memory.dmpFilesize
128KB
-
memory/4088-642-0x0000028CDD400000-0x0000028CDD500000-memory.dmpFilesize
1024KB
-
memory/4088-647-0x0000028CDE540000-0x0000028CDE560000-memory.dmpFilesize
128KB
-
memory/4120-15-0x00007FF9FB580000-0x00007FF9FC041000-memory.dmpFilesize
10.8MB
-
memory/4120-1-0x000002D6A2670000-0x000002D6A2692000-memory.dmpFilesize
136KB
-
memory/4120-11-0x00007FF9FB580000-0x00007FF9FC041000-memory.dmpFilesize
10.8MB
-
memory/4120-0-0x00007FF9FB583000-0x00007FF9FB585000-memory.dmpFilesize
8KB
-
memory/4120-14-0x00007FF9FB580000-0x00007FF9FC041000-memory.dmpFilesize
10.8MB