Analysis
-
max time kernel
4294179s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
08-03-2022 17:30
Static task
static1
Behavioral task
behavioral1
Sample
file1.ps1
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
file1.ps1
Resource
win10v2004-en-20220112
General
-
Target
file1.ps1
-
Size
132KB
-
MD5
9777539c560bfd297cc2574c37fa5b21
-
SHA1
4eb088f40d4cb02590c7299ac7e2c0d609680e1e
-
SHA256
be4f0c6439bdba738482ea253cde60f3347afd86b284362f83b510a0034b693a
-
SHA512
dc3ca59771b57826cd8714c4335ffbdecddd155e234309dd812d0db7bb2a21b590bd73c57d5270f2083e6f616fbf2265f955654ae5f091d9f820ae64beea1e96
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1796 powershell.exe 1524 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1796 powershell.exe Token: SeDebugPrivilege 1524 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
powershell.exedescription pid process target process PID 1796 wrote to memory of 1524 1796 powershell.exe powershell.exe PID 1796 wrote to memory of 1524 1796 powershell.exe powershell.exe PID 1796 wrote to memory of 1524 1796 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file1.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -WIndoWSTYLe HiDdeN -ExecutionPolicy Bypass -file C:\ProgramData\PRESFGEQTFRWEEHBFXQXJU\PRESFGEQTFRWEEHBFXQXJU.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\PRESFGEQTFRWEEHBFXQXJU\PRESFGEQTFRWEEHBFXQXJU.ps1MD5
96cbd4ee164e4feb93152e2ef2d0e229
SHA12f5963d3042b87d5e3684a8c1de74e3543aad81e
SHA2562926650956ac94279c598ba4b761eac9fa34e49e8fe19580adf8c62fd2fac15a
SHA51248df582b45e09a85e94d60502a1d5f68412ea1325d81ceb2256c5a142d09f4db57e2e6f746a55458276aa8d3d9af59ce66219489d9aa9b73c5dac2c8a7d27b5b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
7a2466ed466ee4f21e0e7805ff986ecd
SHA17d14281d1bd702b8ba20aa33ea0e740d209b375b
SHA2561506315dfcec8b5be5f18136de647eb8c5cbac1b4a3c1769624db10a5096b2d1
SHA512e03110621683b35f782fb186e2cdd1a1a260aa43c5e96a55ae883ed6507ff3d904cc84254d2bca569a6fd62209c93c6c3e65967586733ab8e6e204fdaa57c4cb
-
memory/1524-72-0x00000000027DB000-0x00000000027FA000-memory.dmpFilesize
124KB
-
memory/1524-70-0x00000000027D4000-0x00000000027D7000-memory.dmpFilesize
12KB
-
memory/1524-68-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmpFilesize
9.6MB
-
memory/1524-69-0x00000000027D2000-0x00000000027D4000-memory.dmpFilesize
8KB
-
memory/1524-67-0x00000000027D0000-0x00000000027D2000-memory.dmpFilesize
8KB
-
memory/1524-66-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmpFilesize
9.6MB
-
memory/1524-65-0x000007FEEE7F0000-0x000007FEEF34D000-memory.dmpFilesize
11.4MB
-
memory/1796-58-0x000000001B7F0000-0x000000001BAEF000-memory.dmpFilesize
3.0MB
-
memory/1796-62-0x0000000002704000-0x0000000002707000-memory.dmpFilesize
12KB
-
memory/1796-59-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmpFilesize
9.6MB
-
memory/1796-61-0x000000000270B000-0x000000000272A000-memory.dmpFilesize
124KB
-
memory/1796-60-0x0000000002702000-0x0000000002704000-memory.dmpFilesize
8KB
-
memory/1796-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmpFilesize
8KB
-
memory/1796-56-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmpFilesize
9.6MB
-
memory/1796-57-0x0000000002700000-0x0000000002702000-memory.dmpFilesize
8KB
-
memory/1796-55-0x000007FEEE7F0000-0x000007FEEF34D000-memory.dmpFilesize
11.4MB