Analysis
-
max time kernel
94s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
Lykkeskillingerne.exe
Resource
win7-20240903-en
General
-
Target
Lykkeskillingerne.exe
-
Size
517KB
-
MD5
a61d199b40c46ea1e0b9bb6f12165881
-
SHA1
9ce4221b5c7d8a67ba54b0709d5bbcc893ceed02
-
SHA256
c4f370cc453d04a84606b36451353fe65c56a5e758b2c138a23fc3741d7f4df9
-
SHA512
11274f2ea8c4c181e4a0163a947e7d893697db2b0dcb7a280e3a0e37059bb4d02998c0d32b1cc84084fe8e7d9684cec21da708ccefe0628711053626a09beb85
-
SSDEEP
12288:WZGcVEfEyolcupbbn6/tT9XfSJ37tdrQW:WZbSfEyolpb6FTM7dr9
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2676 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4672 2676 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lykkeskillingerne.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2676 powershell.exe 2676 powershell.exe 2676 powershell.exe 2676 powershell.exe 2676 powershell.exe 2676 powershell.exe 2676 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2676 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 548 wrote to memory of 2676 548 Lykkeskillingerne.exe 86 PID 548 wrote to memory of 2676 548 Lykkeskillingerne.exe 86 PID 548 wrote to memory of 2676 548 Lykkeskillingerne.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lykkeskillingerne.exe"C:\Users\Admin\AppData\Local\Temp\Lykkeskillingerne.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Jordomsejling=Get-Content 'C:\Users\Admin\AppData\Local\Detenterne\Chiriguano.Wea';$Materiarian=$Jordomsejling.SubString(55684,3);.$Materiarian($Jordomsejling)2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 27203⤵
- Program crash
PID:4672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2676 -ip 26761⤵PID:3912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD55a15c80c43773c2a95864ddce4db60f3
SHA17e1c9b6e38b52be2b7be175762dfd0e0d1b13b03
SHA2562378274984d8afb8a08a1c7c2c657d6fe39d060607daeed2a021058794e0201c
SHA51255469a4612b9db7a1d4f46f0c04b3e165de687cd51e0193fdc4adeccd4cc241935cf1f5a7db54f159afb03ca618787718a3eaedb50f80b265ebf91903bdd2369
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82