Overview

overview

10

Static

static

3

Windows_Up...xe.vbs

windows7-x64

1

Windows_Up...xe.vbs

windows10-2004-x64

1

file.ps1

windows7-x64

1

file.ps1

windows10-2004-x64

1

fresh.exe

windows7-x64

10

fresh.exe

windows10-2004-x64

10

loader.ps1

windows7-x64

1

loader.ps1

windows10-2004-x64

10

payload.ps1

windows7-x64

1

payload.ps1

windows10-2004-x64

10

update.cmd

windows7-x64

1

update.cmd

windows10-2004-x64

10

update.vbs

windows7-x64

8

update.vbs

windows10-2004-x64

10

windows.cmd

windows7-x64

1

windows.cmd

windows10-2004-x64

10

windows.vbs

windows7-x64

3

windows.vbs

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-03-2024 03:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    loader.ps1

  • Size

    14.0MB

  • MD5

    fe51ec3ec4510262ca50af133b5cef93

  • SHA1

    aba6d26dcfb1fa6c991b2486fc7cda8165b61551

  • SHA256

    1877e4bab37f755a1c74d6e03319da7b42b07a45be4da1205609d4e47aa16e7c

  • SHA512

    149ee9151f9d94c4fa9308de3b81b3f0a13fa2991c1bbf74e48b85f695d2ef3ef7ba1f39f91ef2619c40f6d0a0dc8f25d5452c538084e26d6301ec9273d15b96

  • SSDEEP

    49152:5v8ClP0QiEwg/C5r6iNlqaZg21NY/TQX5I:

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\loader.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1212-4-0x000000001B3D0000-0x000000001B6B2000-memory.dmp
    Filesize

    2.9MB

    Download
  • memory/1212-5-0x000007FEF6320000-0x000007FEF6CBD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/1212-6-0x0000000002990000-0x0000000002A10000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1212-7-0x0000000001D70000-0x0000000001D78000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1212-9-0x0000000002990000-0x0000000002A10000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1212-8-0x000007FEF6320000-0x000007FEF6CBD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/1212-10-0x0000000002990000-0x0000000002A10000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1212-11-0x0000000002990000-0x0000000002A10000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1212-12-0x000007FEF6320000-0x000007FEF6CBD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/1212-13-0x0000000002990000-0x0000000002A10000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1212-14-0x000007FEF6320000-0x000007FEF6CBD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/1212-15-0x0000000002990000-0x0000000002A10000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1212-16-0x0000000002990000-0x0000000002A10000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1212-17-0x0000000002990000-0x0000000002A10000-memory.dmp
    Filesize

    512KB

    Download