Overview

overview

10

Static

static

1

RFQ_List.exe

windows10-1703-x64

10

Maidenliness.ps1

windows10-1703-x64

8

Analysis

  • max time kernel
    579s
  • max time network
    527s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-ja
  • resource tags

    arch:x64arch:x86image:win10-20240404-jalocale:ja-jpos:windows10-1703-x64systemwindows
  • submitted
    23-10-2024 04:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Maidenliness.ps1

  • Size

    52KB

  • MD5

    f80de07a4ce30153f8406db6a12af56e

  • SHA1

    bbe21fa2d5c1c6f2cad16333a3d095547f3426d2

  • SHA256

    510d5a55e94d189ab5afadb87a4fb0be42220646e2b2cb470511c3055c0eeba6

  • SHA512

    248a69f2a9ba266d4a571646f2235f67833edf425f3a0350becd520cc941b556bccd863ec8270de81ee48dc91bcc8f5a9bc71e51a89fd4eed529c843f1e43428

  • SSDEEP

    768:vmhC4iu9gl9h6rLL44XFeko5AQ5JX61IB5w0w9g5OrVrd3dRnxLNEAka8l5Zowvm:vmsJjw744FYwgw0wSgZp0Aka8lHosvY7

Score
8/10
executionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Maidenliness.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4596
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:38840
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:27404
  • C:\Windows\System32\IME\SHARED\imebroker.exe
    C:\Windows\System32\IME\SHARED\imebroker.exe -Embedding
    1⤵
      PID:27116

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xaubfckz.pbm.ps1
      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

      Download Submit

    • memory/4596-2215-0x00000273E9DE0000-0x00000273E9DF6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/4596-11-0x00007FFF4C2E0000-0x00007FFF4CCCC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4596-2187-0x00000273EA3A0000-0x00000273EA3CA000-memory.dmp

      Filesize

      168KB

      Download

    • memory/4596-8-0x00000273E9E30000-0x00000273E9F3E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/4596-2729-0x00000273EA3A0000-0x00000273EA3C0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4596-12-0x00000273E9F40000-0x00000273E9FB6000-memory.dmp

      Filesize

      472KB

      Download

    • memory/4596-13-0x00007FFF4C2E0000-0x00007FFF4CCCC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4596-2901-0x00007FFF4C2E0000-0x00007FFF4CCCC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4596-2034-0x00007FFF4C2E0000-0x00007FFF4CCCC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4596-2206-0x00000273EA3A0000-0x00000273EA3C2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4596-2216-0x00000273E9C00000-0x00000273E9C08000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4596-3-0x00007FFF4C2E3000-0x00007FFF4C2E4000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4596-5-0x00000273E9B40000-0x00000273E9BD2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4596-6-0x00000273E9540000-0x00000273E9550000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4596-7-0x00000273E9C10000-0x00000273E9C32000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4596-14107-0x00007FFF4C2E0000-0x00007FFF4CCCC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4596-23363-0x00007FFF4C2E0000-0x00007FFF4CCCC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4596-23364-0x00007FFF4C2E0000-0x00007FFF4CCCC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4596-23365-0x00007FFF4C2E3000-0x00007FFF4C2E4000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4596-23366-0x00007FFF4C2E0000-0x00007FFF4CCCC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/27404-23370-0x0000022645E00000-0x0000022645F00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/27404-23369-0x0000022645E00000-0x0000022645F00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/27404-23374-0x0000022E478A0000-0x0000022E478C0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/27404-23398-0x0000022E47BD0000-0x0000022E47BF0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/38840-23368-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download