Analysis
- max time kernel
139s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
23/01/2024, 12:49
General
- Target met.ps1
- Size 243B
- Sample240123-p2djcaaddq
- SHA256 5de9e52d170a6c62c8ea81dc8347ef8d12f2141691aa73cb6a5e8e2b9624c761
Malware Config
Extracted
-
metasploit
-
metasploit_stager
-
165.22.23.200:65443
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\met.ps11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_h0akdd3y.ji5.ps1
memory/1988-9-0x0000027AEBC50000-0x0000027AEBC72000-memory.dmp
memory/1988-10-0x00007FFC731D0000-0x00007FFC73C91000-memory.dmp
memory/1988-11-0x0000027AE9B30000-0x0000027AE9B40000-memory.dmp
memory/1988-12-0x0000027AE9B30000-0x0000027AE9B40000-memory.dmp
memory/1988-13-0x0000027AEBFC0000-0x0000027AEBFC8000-memory.dmp
memory/1988-14-0x0000027AEC130000-0x0000027AEC131000-memory.dmp
memory/1988-15-0x0000027AEC130000-0x0000027AEC131000-memory.dmp
memory/1988-16-0x0000027AEC180000-0x0000027AEC1B9000-memory.dmp
memory/1988-20-0x0000027AEC140000-0x0000027AEC172000-memory.dmp
memory/1988-22-0x0000027AEC180000-0x0000027AEC1B9000-memory.dmp
memory/1988-23-0x0000027AEC180000-0x0000027AEC1B9000-memory.dmp
memory/1988-30-0x0000027AEC1C0000-0x0000027AEC22B000-memory.dmp
memory/1988-33-0x0000027AEBD80000-0x0000027AEBF80000-memory.dmp
memory/1988-37-0x0000027AEC180000-0x0000027AEC1B9000-memory.dmp
memory/1988-52-0x0000027AEC230000-0x0000027AEC259000-memory.dmp
memory/1988-55-0x0000027AEBD80000-0x0000027AEBF80000-memory.dmp
memory/1988-59-0x0000027AEC180000-0x0000027AEC1B9000-memory.dmp
memory/1988-60-0x00007FFC731D0000-0x00007FFC73C91000-memory.dmp
memory/1988-61-0x0000027AE9B30000-0x0000027AE9B40000-memory.dmp
memory/1988-62-0x0000027AEC140000-0x0000027AEC172000-memory.dmp
memory/1988-63-0x0000027AEBD80000-0x0000027AEBF80000-memory.dmp
memory/1988-64-0x0000027AEBD80000-0x0000027AEBF80000-memory.dmp