8dc33fa00c5081233fa79e35c7de7bb9769e280f245401dbede7a7d02969b0ba

General

Target

$TEMP/Minsteryard.exe
Size

3.7MB
MD5

1ad3029c8d2a4757628b99efc75a87ef
SHA1

3a6164f653bc11c303c98716764c443fe651b6e8
SHA256

9b7b1e2944d31e405a7d72a08ecf193f509ff52e5670f6813be986ac9ff65ecc
SHA512

f097481515d99e7ddf11fbd09c004c5286e3857fb1fb2c9305a4e491611690f4cf61303654802545a9259762fc1ba18845185ac651d06cdbf83db19133cf0bbe
SSDEEP

98304:beGWFH8Yi0OaTH238L6O2vteL8vxzxBe7SIMg+W:OcV0OE238GOZLK3JNg+W

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3896	powershell.exe
1604	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5084	svchost.exe
3948	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\WindowsPro\svchost.exe	Minsteryard.exe
File opened for modification	C:\Windows\system32\WindowsPro\svchost.exe	Minsteryard.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1096	Minsteryard.exe
3896	powershell.exe
3896	powershell.exe
1604	powershell.exe
1604	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	Minsteryard.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	5084	svchost.exe
Token: SeDebugPrivilege	3948	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4588	1096	Minsteryard.exe	95
PID 1096 wrote to memory of 4588	1096	Minsteryard.exe	95
PID 1096 wrote to memory of 3020	1096	Minsteryard.exe	97
PID 1096 wrote to memory of 3020	1096	Minsteryard.exe	97
PID 4588 wrote to memory of 3896	4588	cmd.exe	99
PID 4588 wrote to memory of 3896	4588	cmd.exe	99
PID 4588 wrote to memory of 1604	4588	cmd.exe	100
PID 4588 wrote to memory of 1604	4588	cmd.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\$TEMP\Minsteryard.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\Minsteryard.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" #cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /f /sc minute /rl highest /mo 1 /tn "Panaesthesia" /tr "C:\Windows\system32\WindowsPro\svchost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3020

C:\Windows\system32\WindowsPro\svchost.exe
C:\Windows\system32\WindowsPro\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\system32\WindowsPro\svchost.exe
C:\Windows\system32\WindowsPro\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
2KB

MD5
3032e4b599fb51e85b5707070b2ff89c

SHA1
02535592e536217c61038bf4bbec25f048cf5a2b

SHA256
0dfad852da614174e2c055214ac47e17d62b0b287b517bb98cc5f188418af96c

SHA512
c49edab4da7df0ce83aa6595697dcadf901e2a80280c28caa474c836f82c9507bf235ff7c2f69940cd3cae5c3acee600d91a6263d6cef1f3f467326b342e58ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
3ca1082427d7b2cd417d7c0b7fd95e4e

SHA1
b0482ff5b58ffff4f5242d77330b064190f269d3

SHA256
31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

SHA512
bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nzxemwv4.bo2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System32\WindowsPro\svchost.exe

Filesize
10.8MB

MD5
64c2f8edb85662fa7b8978bbc13c0b9d

SHA1
f752396c71d0e0c26fda142ca4e395e2c58bcd3e

SHA256
ab77d1bcda8ef732efaa52738449f71101dee687f60902b2ad2aecbe507ca9ac

SHA512
a3e340fc7fc3fb5d9626b173febc2b89ff93969012d1a9ca33772d864cf2052e07f65889787ed7282a8a59cefde95922306db43fb5cf1fc5e4aa674aba3e3ba7

Download Submit
memory/1096-10-0x000002BBD7480000-0x000002BBD794C000-memory.dmp

Filesize
4.8MB

Download
memory/1096-3-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

Filesize
10.8MB

Download
memory/1096-7-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

Filesize
10.8MB

Download
memory/1096-8-0x000002BBD5760000-0x000002BBD5A86000-memory.dmp

Filesize
3.1MB

Download
memory/1096-9-0x000002BBD6D50000-0x000002BBD6FB0000-memory.dmp

Filesize
2.4MB

Download
memory/1096-0-0x00007FF95A713000-0x00007FF95A715000-memory.dmp

Filesize
8KB

Download
memory/1096-11-0x000002BBD54D0000-0x000002BBD54E2000-memory.dmp

Filesize
72KB

Download
memory/1096-5-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

Filesize
10.8MB

Download
memory/1096-1-0x000002BBB9E30000-0x000002BBBA1E2000-memory.dmp

Filesize
3.7MB

Download
memory/1096-6-0x00007FF95A713000-0x00007FF95A715000-memory.dmp

Filesize
8KB

Download
memory/1096-2-0x000002BBD4730000-0x000002BBD4A62000-memory.dmp

Filesize
3.2MB

Download
memory/1096-4-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

Filesize
10.8MB

Download
memory/3896-18-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

Filesize
10.8MB

Download
memory/3896-32-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

Filesize
10.8MB

Download
memory/3896-29-0x0000023E64A50000-0x0000023E64A72000-memory.dmp

Filesize
136KB

Download
memory/3896-19-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

Filesize
10.8MB

Download
memory/3896-17-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads