9353635f565f1a3b0c4caa28f268f30271e12709d921ea87969cd4e7d2b8c642

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 15:16

Target

nrwncpwo.ps1
Size

350B
MD5

4dcabdc088c563712db30a16ed19dd52
SHA1

5758984a8840f3af5624e1149b306e8efd9ae483
SHA256

9353635f565f1a3b0c4caa28f268f30271e12709d921ea87969cd4e7d2b8c642
SHA512

a84614600f27918ac5490360873128bf6a7b6a8181efc64608b1045913a9ddd27f18e1b3d175e68e2f64d221a08fd160b122a0e4f5540e5bb828c5be9a60e40f

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1804	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2576	1804	powershell.exe	29
PID 1804 wrote to memory of 2576	1804	powershell.exe	29
PID 1804 wrote to memory of 2576	1804	powershell.exe	29

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

pid	Process
2576	attrib.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\nrwncpwo.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h C:/rimz
  2⤵
  - Views/modifies file attributes
  PID:2576

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1804-5-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/1804-7-0x0000000002A40000-0x0000000002AC0000-memory.dmp

Filesize
512KB

Download
memory/1804-6-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/1804-4-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/1804-8-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/1804-9-0x0000000002A40000-0x0000000002AC0000-memory.dmp

Filesize
512KB

Download
memory/1804-10-0x0000000002A40000-0x0000000002AC0000-memory.dmp

Filesize
512KB

Download
memory/1804-11-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download