Analysis

  • max time kernel
    72s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    19-10-2021 14:45

General

  • Target

    z.ps1

  • Size

    885KB

  • MD5

    f5823f4078ed9420c7a716cb61f8ba6c

  • SHA1

    5a4fefe3e37b29ec3065a2f80300ab9d79d3e68d

  • SHA256

    8004875f540cbaf1fe2d3844a66c67bbf4b885dd592450c9a5f420fbca0f044d

  • SHA512

    aab8d42e87e97600ec958d747f75c82899cd82fd2b63b538b8bbc59867ad26a09db3c8fb156d4a7b1e143a4042997d3324662715d6ed8c2eab0211efe03251bd

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\z.ps1
    1⤵
    • Blocklisted process makes network request
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2196-115-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-116-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-117-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-118-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-119-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-120-0x000001E45B0C0000-0x000001E45B0C1000-memory.dmp

    Filesize

    4KB

  • memory/2196-121-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-122-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-123-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-125-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-126-0x000001E45B0F3000-0x000001E45B0F5000-memory.dmp

    Filesize

    8KB

  • memory/2196-124-0x000001E45B0F0000-0x000001E45B0F2000-memory.dmp

    Filesize

    8KB

  • memory/2196-127-0x000001E45D350000-0x000001E45D351000-memory.dmp

    Filesize

    4KB

  • memory/2196-128-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-129-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-130-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-131-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-132-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-133-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-134-0x000001E45B0F6000-0x000001E45B0F8000-memory.dmp

    Filesize

    8KB

  • memory/2196-135-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-136-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-137-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-138-0x000001E4412E0000-0x000001E4412E2000-memory.dmp

    Filesize

    8KB

  • memory/2196-139-0x000001E4412E0000-0x000001E4412E5000-memory.dmp

    Filesize

    20KB

  • memory/2196-218-0x000001E45B0F8000-0x000001E45B0F9000-memory.dmp

    Filesize

    4KB

  • memory/2196-266-0x000001E45B0F9000-0x000001E45B0FF000-memory.dmp

    Filesize

    24KB