Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 01:33
Static task
static1
Behavioral task
behavioral1
Sample
68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exe
Resource
win10v2004-20240508-en
General
-
Target
68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exe
-
Size
914KB
-
MD5
685957fc8d1cb9176598abbd85f01b88
-
SHA1
3d32596650fce3cf7687bbbc72caffc821d25887
-
SHA256
68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3
-
SHA512
f111150ea54da60ba4eed011b2acb3918a53075c45cb28f084b045bf94662e6af5f609b2f549cc38eb65d823699a5f70bca77fa5dbd864fc895c298b62f75e32
-
SSDEEP
12288:+BfOreqYlj4XT9/VPsvkf3kLXUuq9HyBbqpqfyl0fGXJ9BqNJowksVg:QOreqYJWfqEukLEO0fG5vq7H+
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4656 1384 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepid process 1384 powershell.exe 1384 powershell.exe 1384 powershell.exe 1384 powershell.exe 1384 powershell.exe 1384 powershell.exe 1384 powershell.exe 1384 powershell.exe 1384 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1384 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exedescription pid process target process PID 3068 wrote to memory of 1384 3068 68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exe powershell.exe PID 3068 wrote to memory of 1384 3068 68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exe powershell.exe PID 3068 wrote to memory of 1384 3068 68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exe"C:\Users\Admin\AppData\Local\Temp\68e7f4d2bf863ba81f7df626105d057cce0280693d8d1c6229d5a5b7a5b13ac3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Solert=Get-Content 'C:\Users\Admin\AppData\Local\twinsomeness\Carl.Ste';$Tudehornene=$Solert.SubString(59503,3);.$Tudehornene($Solert)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 24563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1384 -ip 13841⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wqm5qsrj.fah.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\twinsomeness\Carl.SteFilesize
68KB
MD514007bbf3c87abdfd3a69719009624dd
SHA10766cab9e60ddaa8bcd341e23ba6d7be5507533c
SHA25622149260143dfca383be6daedad36ebf48a522d1bc86405ef46ebfcc524bb45f
SHA51280b33f204d558513d8097068f3f211700dbd91927467d388e849d455f1b4550c5b4f97f4bbd216d97a637881cdfb433dbeb56b3408c904984a619563ca3e2396
-
memory/1384-13-0x0000000073ED0000-0x0000000074680000-memory.dmpFilesize
7.7MB
-
memory/1384-28-0x0000000006080000-0x00000000060CC000-memory.dmpFilesize
304KB
-
memory/1384-9-0x0000000073EDE000-0x0000000073EDF000-memory.dmpFilesize
4KB
-
memory/1384-14-0x0000000005080000-0x00000000050A2000-memory.dmpFilesize
136KB
-
memory/1384-16-0x00000000058F0000-0x0000000005956000-memory.dmpFilesize
408KB
-
memory/1384-15-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/1384-11-0x0000000073ED0000-0x0000000074680000-memory.dmpFilesize
7.7MB
-
memory/1384-26-0x0000000005A60000-0x0000000005DB4000-memory.dmpFilesize
3.3MB
-
memory/1384-27-0x0000000006040000-0x000000000605E000-memory.dmpFilesize
120KB
-
memory/1384-12-0x00000000051E0000-0x0000000005808000-memory.dmpFilesize
6.2MB
-
memory/1384-29-0x00000000065C0000-0x0000000006656000-memory.dmpFilesize
600KB
-
memory/1384-30-0x0000000006560000-0x000000000657A000-memory.dmpFilesize
104KB
-
memory/1384-31-0x0000000007030000-0x0000000007052000-memory.dmpFilesize
136KB
-
memory/1384-32-0x0000000007610000-0x0000000007BB4000-memory.dmpFilesize
5.6MB
-
memory/1384-10-0x0000000002A50000-0x0000000002A86000-memory.dmpFilesize
216KB
-
memory/1384-34-0x0000000008240000-0x00000000088BA000-memory.dmpFilesize
6.5MB
-
memory/1384-36-0x0000000073ED0000-0x0000000074680000-memory.dmpFilesize
7.7MB