Resubmissions
15/04/2024, 15:04
240415-sftvzsbe51808/04/2024, 10:37
240408-mn29faad6t125/03/2024, 12:10
240325-pcfbmsfb49828/11/2023, 12:14
231128-pefp7ahg9v828/11/2023, 10:30
231128-mj2gcahc28815/05/2023, 08:26
230515-kb2q2ahh2t819/04/2023, 08:41
230419-klhe5shd66814/02/2023, 10:51
230214-mxtnnacg59804/01/2023, 12:47
230104-p1dgysah518Analysis
- max time kernel
373s - max time network
383s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
19/04/2023, 08:41
General
- Target from_r_techsupport_post_zfbprl.ps1
- Size 3KB
- Sample230419-klhe5shd66
- SHA256 2573edb9592715b7e0048056279d6d707c959fe815148f733e60b4eb0fca3aea
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\from_r_techsupport_post_zfbprl.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
__PSScriptPolicyTest_rqxi4kwz.qun.ps1
memory/996-175-0x000001AB10AC0000-0x000001AB10AD0000-memory.dmp
memory/996-187-0x000001AB10AC0000-0x000001AB10AD0000-memory.dmp
memory/996-186-0x000001AB10AC0000-0x000001AB10AD0000-memory.dmp
memory/996-185-0x000001AB10AC0000-0x000001AB10AD0000-memory.dmp
memory/996-184-0x000001AB2CBB0000-0x000001AB2D0D8000-memory.dmp
memory/996-179-0x000001AB2C3E0000-0x000001AB2C456000-memory.dmp
memory/996-178-0x000001AB10AC0000-0x000001AB10AD0000-memory.dmp
memory/996-176-0x000001AB10AC0000-0x000001AB10AD0000-memory.dmp
memory/996-177-0x000001AB2C310000-0x000001AB2C354000-memory.dmp
memory/2612-180-0x00000207796C0000-0x00000207796D0000-memory.dmp
memory/2612-162-0x00000207796C0000-0x00000207796D0000-memory.dmp
memory/2612-163-0x00000207796C0000-0x00000207796D0000-memory.dmp
memory/2612-164-0x00000207796C0000-0x00000207796D0000-memory.dmp
memory/2612-165-0x000002077CBA0000-0x000002077CD62000-memory.dmp
memory/2612-182-0x00000207796C0000-0x00000207796D0000-memory.dmp
memory/2612-181-0x00000207796C0000-0x00000207796D0000-memory.dmp
memory/4724-148-0x00000284AC110000-0x00000284AC120000-memory.dmp
memory/4724-149-0x00000284AC110000-0x00000284AC120000-memory.dmp
memory/4724-150-0x00000284AC110000-0x00000284AC120000-memory.dmp
memory/4724-147-0x00000284AF0B0000-0x00000284AF0CA000-memory.dmp
memory/4724-151-0x0000028567E00000-0x0000028567F76000-memory.dmp
memory/4724-152-0x0000028568190000-0x000002856839A000-memory.dmp
memory/4724-146-0x00000284AF080000-0x00000284AF090000-memory.dmp
memory/4724-144-0x00000284AC110000-0x00000284AC120000-memory.dmp
memory/4724-145-0x00000284AC110000-0x00000284AC120000-memory.dmp
memory/4724-143-0x00000284AC110000-0x00000284AC120000-memory.dmp
memory/4724-142-0x00000284AF040000-0x00000284AF062000-memory.dmp