0392634ea11705b38c167ea39cdf43d6a88febf963ec10247ca8ef99183fb304

Analysis

max time kernel
17s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script.ps1
Size

505B
MD5

126d0143c4a72b552b57453b5144bdae
SHA1

01a67e78816f59293209b0858d0d4c07aaee75a4
SHA256

7f1bfe31baacd8ec5ae271d00b32bc39b244191a99349b570d4d16ef77a4eaab
SHA512

a69ecbb60fbe62b1035ff254645e975ddbf9adc0e34bf0a392c7631b14b9ed0f1b081c7a6eed0cb24ebfb369caeba7eeb54b41e16db29304c2b334f60ce4261e

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrveSync = "C:\\Users\\Admin\\AppData\\Roaming\\OneDrveSync\\client32.exe"	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1328 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1328 powershell.exe

pid	process
1328	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1328	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-58-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1328-59-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1328-60-0x000000001B290000-0x000000001B572000-memory.dmp

Filesize
2.9MB

Download
memory/1328-61-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/1328-62-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1328-63-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download