Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2024 09:11
Static task
static1
Behavioral task
behavioral1
Sample
Opgaveforlb.exe
Resource
win7-20240903-en
General
-
Target
Opgaveforlb.exe
-
Size
605KB
-
MD5
b59ef60d3216aa6ace0a7f3a5410436b
-
SHA1
8eea1ab92d68fc821e9d6d6eeb37ff5f07d7f1bb
-
SHA256
468f0f730fe384bb0b6e88941bcdf91679da1c374ff272e2309ca4c123a848a7
-
SHA512
6f7eb71c8f715effd1ef7dac582dbdaa6fcd95f831692ed239522ddb84da4d9026faf58954b81b4a40d5c0cb8c58c71b2446f049403222bc05cd68abc0957d07
-
SSDEEP
12288:qBIJsQ8JMOMcV7tywhFMCE474goh+dod6uOCC/:TJsQZwoCl0n6wC/
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2656 4984 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Opgaveforlb.exepowershell.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opgaveforlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepid Process 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 4984 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Opgaveforlb.exedescription pid Process procid_target PID 3140 wrote to memory of 4984 3140 Opgaveforlb.exe 83 PID 3140 wrote to memory of 4984 3140 Opgaveforlb.exe 83 PID 3140 wrote to memory of 4984 3140 Opgaveforlb.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Opgaveforlb.exe"C:\Users\Admin\AppData\Local\Temp\Opgaveforlb.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$has=Get-Content 'C:\Users\Admin\AppData\Roaming\Palaeodictyopteron\testudskrivningsfaciliteters\Marinerede\Berrings.Non195';$Nuanced=$has.SubString(56164,3);.$Nuanced($has)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 21203⤵
- Program crash
PID:2656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4984 -ip 49841⤵PID:3660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Palaeodictyopteron\testudskrivningsfaciliteters\Marinerede\Berrings.Non195
Filesize54KB
MD5412432fa75ddc2549f05b0a3ef362124
SHA11e4e8ac5d1ad5b0fee24213f5860408dbf039055
SHA256ce60e666a334f8752b76ee6304ebe8d9760ad21824a40695185fbe2103a16467
SHA51278bb11c2c8389e1c5b758492be9f1334ad82451a7ab94a56ed6916991314e3304878b8d1be62a9f5ba0930ed26c342228ee4083480a46a349af1771f2240e60e