aa37df1d0056bfef77994dd021be3e729aac4311d6bda42c049e251f2005671a

Analysis

max time kernel
65s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 01:42

Target
ps2.ps1
Size 2KB
Sample221101-b4nkfafad3
SHA256 aa37df1d0056bfef77994dd021be3e729aac4311d6bda42c049e251f2005671a
MD5 1e204dd27752929167c34059a8e163c9
SHA1 70b1a1e1c93495cbbc67f7453416848898aadc47
SHA512 2a84868aaa0fb9e33aaf16a486e2d386fb8c06afdac501c4bec3f972539be6768003e72b18dbbb7a540a09adb435969cb4aa8bdc3dcfbd81263eb0316b8c8e4e
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	2740	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	powershell.exe
2740	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4744	2740	powershell.exe	80
PID 2740 wrote to memory of 4744	2740	powershell.exe	80

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps2.ps1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\newmodeler.dll Default
  2⤵
  PID:4744

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/2740-132-0x000001F7B2670000-0x000001F7B2692000-memory.dmp

Download

memory/2740-133-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Download

memory/2740-135-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Download