Resubmissions
21-09-2024 01:58
240921-cdy4xszdnb 1021-09-2024 01:55
240921-cb94eazdql 1021-09-2024 01:54
240921-cbs5wszcrc 1020-09-2024 22:19
240920-18ynms1gln 10Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
21-09-2024 01:58
Static task
static1
Behavioral task
behavioral1
Sample
download.ps1
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
150 seconds
General
-
Target
download.ps1
-
Size
222B
-
MD5
4225b2ad70add8281a8d8ac6e1c5d9da
-
SHA1
85bb57d35c69a159849b694b80618f1de6b8633c
-
SHA256
10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f
-
SHA512
412d63aaf85d2ba0c48bd9513484731d84f83b231b8b0ac88de102c54e06e5a126e2a0ea1c266849b369e2084d4f37624d899ea420e771a17fc14227ee56b4a6
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 224 powershell.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
pid Process 224 powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 taskmgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000035594d0f100054656d7000003a0009000400efbe8458096235594d0f2e00000000000000000000000000000000000000000000000000e26d5300540065006d007000000014000000 taskmgr.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 224 powershell.exe 224 powershell.exe 224 powershell.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 1008 powershell_ise.exe 3240 taskmgr.exe 1008 powershell_ise.exe 1008 powershell_ise.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3240 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 224 powershell.exe Token: SeDebugPrivilege 3240 taskmgr.exe Token: SeSystemProfilePrivilege 3240 taskmgr.exe Token: SeCreateGlobalPrivilege 3240 taskmgr.exe Token: SeDebugPrivilege 1008 powershell_ise.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\download.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:224
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3240
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1040
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\AppData\Local\Temp\download.ps1"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a