Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2024 13:49

General

  • Target

    Company Profile and new order-202401127.scr

  • Size

    779KB

  • MD5

    935bdb714d2c6a118e9c6bfd941084b8

  • SHA1

    817f3f195d61d459fbbdac24e5a4f014d927edcf

  • SHA256

    c69b2064c89c254dbeda8f204b3a60ab753816ddff618be9d593cb9839cfe09d

  • SHA512

    6915674b2cf0bbc300f18dc26fd983bb69d5ddf8ec7d00831915ae6d5602d0b770d5e785ab8b0d33b9e0c353773e2777273ff6e8383d7332a54fe2440976ede4

  • SSDEEP

    12288:XXa6zw6GW2F+5XizizdI+9kUWM6vQWO0v1wb1EVLz56TE/n0koAHf9qo05bWYpD/:XXal655XEIimkUd0dPpL04/9X05bj

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Company Profile and new order-202401127.scr
    "C:\Users\Admin\AppData\Local\Temp\Company Profile and new order-202401127.scr" /S
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Vagtselskabets=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\nonopposable\ff4\Burglarproofs\bordskaaneren.Exp';$wullawins=$Vagtselskabets.SubString(21189,3);.$wullawins($Vagtselskabets)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2940-7-0x0000000073B11000-0x0000000073B12000-memory.dmp

    Filesize

    4KB

  • memory/2940-8-0x0000000073B10000-0x00000000740BB000-memory.dmp

    Filesize

    5.7MB

  • memory/2940-9-0x0000000073B10000-0x00000000740BB000-memory.dmp

    Filesize

    5.7MB

  • memory/2940-11-0x0000000073B10000-0x00000000740BB000-memory.dmp

    Filesize

    5.7MB

  • memory/2940-12-0x0000000073B10000-0x00000000740BB000-memory.dmp

    Filesize

    5.7MB

  • memory/2940-10-0x0000000073B10000-0x00000000740BB000-memory.dmp

    Filesize

    5.7MB

  • memory/2940-13-0x0000000073B10000-0x00000000740BB000-memory.dmp

    Filesize

    5.7MB