Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2023 01:37
Static task
static1
Behavioral task
behavioral1
Sample
09094ed7deb2b722d47c888b47bc8d71b33355e5052b6e42621e4e98642e7ea9.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
09094ed7deb2b722d47c888b47bc8d71b33355e5052b6e42621e4e98642e7ea9.ps1
Resource
win10v2004-20230220-en
General
-
Target
09094ed7deb2b722d47c888b47bc8d71b33355e5052b6e42621e4e98642e7ea9.ps1
-
Size
363KB
-
MD5
80e2da1c20715a24e2cffda025879bb2
-
SHA1
886a5a3f2a375458e332b7f667a4cc2c36f6a989
-
SHA256
09094ed7deb2b722d47c888b47bc8d71b33355e5052b6e42621e4e98642e7ea9
-
SHA512
69b973d54cdfc842f32fa184211113c3ae93f5a5eb163c6d4997148998077d94add60d96243c1dd18a5e6bdbb858da50481e2ef866082d7ea5398dadbd4cb1a7
-
SSDEEP
6144:8Znnz2AHVD16Sn+KlfYY07hFo8jcNHKIS0MNd1re83NXsaly5q6LAV:8Rn6KPfvATzaKIS0TKNXT56LAV
Malware Config
Extracted
cobaltstrike
987654321
http://kihurij.com:443/Demo/Internet/FT2F740QMYJ
-
access_type
512
-
beacon_type
2048
-
host
kihurij.com,/Demo/Internet/FT2F740QMYJ
-
http_header1
AAAACgAAADhBY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24sIGFwcGxpY2F0aW9uL3hodG1sK3htbCwgaW1hZ2UvKgAAAAoAAAAWQWNjZXB0LUxhbmd1YWdlOiBlbi1pZQAAAAoAAAAfQWNjZXB0LUVuY29kaW5nOiBnemlwLCBpZGVudGl0eQAAAAcAAAAAAAAADwAAAAsAAAACAAAAI1NFU1NJT05JRF82QlBTMjFJOUZLSFJXMlFZRlhMMkZGMDU9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAADhBY2NlcHQ6IGFwcGxpY2F0aW9uL3hodG1sK3htbCwgaW1hZ2UvKiwgYXBwbGljYXRpb24vanNvbgAAAAoAAAAWQWNjZXB0LUxhbmd1YWdlOiBydS1tZAAAAAoAAAAjQWNjZXB0LUVuY29kaW5nOiBpZGVudGl0eSwgY29tcHJlc3MAAAAHAAAAAAAAAA8AAAANAAAABQAAAAlfQ1BLUEtTVFkAAAAHAAAAAQAAAA8AAAAIAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
12544
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\getmac.exe /V
-
sc_process64
%windir%\sysnative\getmac.exe /V
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFpKj6wjeTv+jkvV2oKPV4oxmMWb/goJlnmx050yZrWRDPbb7kmST84pjx2qmD4N240vuPpIy3JzjfximH+OiBDmz1q6T2WrjeDJT9gcSbsyE857XflDEK73pqcmWPQyTLE4d2TaoqjExNiH0fG4h1aChr1NBa4bBCRyb4TsurxQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
8.72947712e+08
-
unknown2
AAAABAAAAAEAAASeAAAAAgAAA44AAAAIAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/Put/2003/WAIV922G69FS
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
-
watermark
987654321
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request 21 IoCs
Processes:
powershell.exeflow pid process 15 628 powershell.exe 31 628 powershell.exe 38 628 powershell.exe 39 628 powershell.exe 41 628 powershell.exe 47 628 powershell.exe 53 628 powershell.exe 65 628 powershell.exe 76 628 powershell.exe 78 628 powershell.exe 79 628 powershell.exe 80 628 powershell.exe 81 628 powershell.exe 82 628 powershell.exe 83 628 powershell.exe 84 628 powershell.exe 85 628 powershell.exe 86 628 powershell.exe 87 628 powershell.exe 88 628 powershell.exe 89 628 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 628 powershell.exe 628 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 628 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\09094ed7deb2b722d47c888b47bc8d71b33355e5052b6e42621e4e98642e7ea9.ps11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w34oeds2.0ai.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/628-135-0x000002AAFE4F0000-0x000002AAFE512000-memory.dmpFilesize
136KB
-
memory/628-143-0x000002AAFE520000-0x000002AAFE530000-memory.dmpFilesize
64KB
-
memory/628-144-0x000002AAFE520000-0x000002AAFE530000-memory.dmpFilesize
64KB
-
memory/628-145-0x000002AAFE520000-0x000002AAFE530000-memory.dmpFilesize
64KB
-
memory/628-146-0x000002AAFF320000-0x000002AAFF3A8000-memory.dmpFilesize
544KB
-
memory/628-147-0x000002AAFF2D0000-0x000002AAFF314000-memory.dmpFilesize
272KB
-
memory/628-148-0x000002AAFF5D0000-0x000002AAFF5D2000-memory.dmpFilesize
8KB
-
memory/628-149-0x000002AAFE520000-0x000002AAFE530000-memory.dmpFilesize
64KB
-
memory/628-150-0x000002AAFE520000-0x000002AAFE530000-memory.dmpFilesize
64KB
-
memory/628-151-0x000002AAFE520000-0x000002AAFE530000-memory.dmpFilesize
64KB
-
memory/628-152-0x000002AAFF2D0000-0x000002AAFF314000-memory.dmpFilesize
272KB