44f9ab2193eaec18892a0a6a3e302923f8e612d0621a364b68491f9e1b46ec2b

General

Target
Gamebar remove.ps1
Size 2KB
Sample260717-1c3mqaav21
SHA256 44f9ab2193eaec18892a0a6a3e302923f8e612d0621a364b68491f9e1b46ec2b
MD5 d866df9a899c91cd3ab2605f150add6a
SHA1 9de175a568e54aabb7f12fd4ff76ceeff10cb4fa
SHA512 fbc9859a3f083c26f13e61e5cd4219710a79344e27b65bcc1bd3cb267259f059e90164de1e43b01e8aa5c1a3a5c6bd3d2eb2ac1a5df8d55a1ed5dd04b80ef5a7
TLSH
T19C51A6EACDD508A7E732225A8CA1DDA6F59FC65E0141091EF5C0B1CD718D8BC8760BBB
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3680	PowerShell.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebar\NoOpenWith	PowerShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebar\shell\open\command\ = "\"C:\\Windows\\System32\\systray.exe\""	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebarservices\shell\open	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebar\shell\open	PowerShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebar\ = "URL:ms-gamebar"	PowerShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebar\URL Protocol	PowerShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\ms-gamebarservices\ = "URL:ms-gamebarservices"	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamingoverlay	PowerShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\ms-gamingoverlay\ = "URL:ms-gamingoverlay"	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebarservices	PowerShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\ms-gamebarservices\URL Protocol	PowerShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\ms-gamebarservices\NoOpenWith	PowerShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebarservices\shell\open\command\ = "\"C:\\Windows\\System32\\systray.exe\""	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamingoverlay\shell\open\command	PowerShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\ms-gamingoverlay\NoOpenWith	PowerShell.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebar\shell\open\command	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebarservices\shell	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebarservices\shell\open\command	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamingoverlay\shell	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamingoverlay\shell\open	PowerShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\ms-gamingoverlay\URL Protocol	PowerShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamingoverlay\shell\open\command\ = "\"C:\\Windows\\System32\\systray.exe\""	PowerShell.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebar\shell	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-gamebar	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3680	PowerShell.exe
3680	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	PowerShell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1220	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3340	3680	PowerShell.exe	81

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Gamebar remove.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\System32\systray.exe
  "C:\Windows\System32\systray.exe"
  2⤵
  PID:3340

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 20KB
SHA256 0d1822d8515e957ecb53acd283a8fdfb33a48bf92dcd2c40269f4014d3d65d70
MD5 e1c6a495d105b68c978b661b4a9dd96a
SHA1 88c4ff6f2a543aa020f908960c898097a9b30a3d
SHA512 746f694dfb8244316e3e672d5f93a2a92e9efcc2a5d82959867a20172d77478912ed307b35b502888c9aff77c8d3ab418ef7299668d8d40a5524b08bf20c29a8
SSDEEP 384:pJWJLVca12krtuVm+DYglBOVjeQ8RJoE5gh0jU+jW+5P/m5m+GDa50R/ocx3a:n+LVcWrll8RJb5gKjU+jrwm+GDa50R/E
TLSH
T12C9239743AF41356F3B29F759EF1A95A643AB862AC00DB5D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 20KB
SHA256 05f5f41bd6027217f2603b0865e03c5490658a666ef4a1c9e6a3558c6ca818e9
MD5 3b558accd8756743697edd6149441cab
SHA1 291e9ab2440d9eba607d5784ec65b5f294575aa4
SHA512 b80d40144f5035675569ab39196a508c063c1f0bae64268e75c032c477f9d72b32539debc67b451300a51043ba0251e464e3c6aeac7088219d301db6585a193b
SSDEEP 384:oJWJLVca12krtuVm+DYglBOVjeQ8RJoS5gh0jU+jW+5P/m5m+GDa50R/ocx3a:k+LVcWrll8RJh5gKjU+jrwm+GDa50R/E
TLSH
T1269239743AF41355F3B29F749EF1A95AA43AB866AC00DB5D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tkeqhvb3.i3z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tkeqhvb3.i3z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3680-0-0x0000017D58660000-0x0000017D58670000-memory.dmp

Download

memory/3680-1-0x0000017D58600000-0x0000017D58622000-memory.dmp

Download

memory/3680-8-0x0000017D58660000-0x0000017D58670000-memory.dmp

Download

memory/3680-9-0x0000017D58660000-0x0000017D58670000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads