Analysis

  • max time kernel
    139s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 11:14

General

  • Target

    Nettably.exe

  • Size

    698KB

  • MD5

    0815e4fcd9b75660891ec15ce119fa70

  • SHA1

    7f8c1c73194725dce424b72ff2306203f3590c3b

  • SHA256

    89a9123df318a4c77a378e687f5e4c1c7f7806d64c85a7360a556b487343a49b

  • SHA512

    c613b96c177294bbbfce2e0b86d15f32d2c7c579bf4c50ef0940ae697e7cfa0f36512ff7fa221c2a5b6963ca6b000b34876707bdc56351c20d20a3ee54fa68ba

  • SSDEEP

    12288:67MJHZFQpHB5LOBTCUbINBoQYwXsCGJt5aFp0zS6w+CAG0snsQc:6IJHoph5CBTCUUN6QYwZrH6VfAsQc

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nettably.exe
    "C:\Users\Admin\AppData\Local\Temp\Nettably.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Kludgy=Get-Content 'C:\Users\Admin\AppData\Local\errancies\Tansies.Tem';$Crushes53=$Kludgy.SubString(52844,3);.$Crushes53($Kludgy)
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2160
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 2692
        3⤵
        • Program crash
        PID:4204
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2160 -ip 2160
    1⤵
      PID:3092

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sxf2dnkb.mub.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\errancies\Tansies.Tem

      Filesize

      51KB

      MD5

      5d38b5b5dd9df5889a8cdae91bda8ce0

      SHA1

      55d4f7428bfc7a1c572e2f65d2877f53dfe9b00c

      SHA256

      45c83c93a697679fb2f35ba68b3df5393398970f0adbda0f8af697080a661a07

      SHA512

      9632d65d07e63235746f60133dfeaad9474db92a70d2264300d3f433399b0ca0e647120d3393d07e5f722597ec1e14a4111f9b0819886cb11f646d75c1e6be8d

    • memory/2160-11-0x0000000075040000-0x00000000757F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2160-26-0x0000000006450000-0x000000000649C000-memory.dmp

      Filesize

      304KB

    • memory/2160-7-0x000000007504E000-0x000000007504F000-memory.dmp

      Filesize

      4KB

    • memory/2160-12-0x0000000005460000-0x0000000005482000-memory.dmp

      Filesize

      136KB

    • memory/2160-14-0x0000000005DB0000-0x0000000005E16000-memory.dmp

      Filesize

      408KB

    • memory/2160-13-0x0000000005D40000-0x0000000005DA6000-memory.dmp

      Filesize

      408KB

    • memory/2160-10-0x0000000075040000-0x00000000757F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2160-24-0x0000000005E20000-0x0000000006174000-memory.dmp

      Filesize

      3.3MB

    • memory/2160-25-0x0000000006400000-0x000000000641E000-memory.dmp

      Filesize

      120KB

    • memory/2160-9-0x00000000054E0000-0x0000000005B08000-memory.dmp

      Filesize

      6.2MB

    • memory/2160-28-0x0000000006940000-0x000000000695A000-memory.dmp

      Filesize

      104KB

    • memory/2160-29-0x0000000006980000-0x00000000069A2000-memory.dmp

      Filesize

      136KB

    • memory/2160-27-0x00000000075F0000-0x0000000007686000-memory.dmp

      Filesize

      600KB

    • memory/2160-30-0x0000000007C40000-0x00000000081E4000-memory.dmp

      Filesize

      5.6MB

    • memory/2160-8-0x0000000002E20000-0x0000000002E56000-memory.dmp

      Filesize

      216KB

    • memory/2160-32-0x0000000008870000-0x0000000008EEA000-memory.dmp

      Filesize

      6.5MB

    • memory/2160-33-0x0000000075040000-0x00000000757F0000-memory.dmp

      Filesize

      7.7MB