1d3e573d432ef094fba33f615aa0564feffa99853af77e10367f54dc6df95509

Analysis

max time kernel
128s
max time network
141s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/01/2023, 19:13

Target

shvnc.ps1
Size

474KB
MD5

10e75f522c3a52532d124e507d1d6561
SHA1

4e693689526ee28290ddd9cdd242a3c5f0383b8d
SHA256

1d3e573d432ef094fba33f615aa0564feffa99853af77e10367f54dc6df95509
SHA512

8b07ad00082f34dd605e0af129d652399269f788ae6fc175ea4cd0332960152d58abc6262fd22ddb182420e63055f45032cef9da9e9d4b4aa1116c5197b1e43f
SSDEEP

12288:tcghEYrnwA1gQxfk5RcABoR0gD3G/xHB67:t3hnFgQdjX3zG/xHA7

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1096	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 1796	1096	powershell.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	1096	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1096	powershell.exe
1096	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeTcbPrivilege	1096	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1096	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1796	1096	powershell.exe	27
PID 1096 wrote to memory of 1796	1096	powershell.exe	27
PID 1096 wrote to memory of 1796	1096	powershell.exe	27
PID 1096 wrote to memory of 1796	1096	powershell.exe	27
PID 1096 wrote to memory of 972	1096	powershell.exe	28
PID 1096 wrote to memory of 972	1096	powershell.exe	28
PID 1096 wrote to memory of 972	1096	powershell.exe	28

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\shvnc.ps1
1⤵
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\Wbem\WmiPrvSE.exe
  WmiPrvSE.exe
  2⤵
  PID:1796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1096 -s 916
  2⤵
  - Program crash
  PID:972

memory/1096-54-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1096-55-0x000007FEF4760000-0x000007FEF5183000-memory.dmp

Filesize
10.1MB

Download
memory/1096-56-0x000007FEF3C00000-0x000007FEF475D000-memory.dmp

Filesize
11.4MB

Download
memory/1096-57-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/1096-62-0x000000000243B000-0x000000000245A000-memory.dmp

Filesize
124KB

Download
memory/1096-63-0x000000001B9F0000-0x000000001BA38000-memory.dmp

Filesize
288KB

Download
memory/1096-66-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/1796-58-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/1796-60-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/1796-64-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download