Resubmissions
15/04/2024, 15:04
240415-sftvzsbe51808/04/2024, 10:37
240408-mn29faad6t125/03/2024, 12:10
240325-pcfbmsfb49828/11/2023, 12:14
231128-pefp7ahg9v828/11/2023, 10:30
231128-mj2gcahc28815/05/2023, 08:26
230515-kb2q2ahh2t819/04/2023, 08:41
230419-klhe5shd66814/02/2023, 10:51
230214-mxtnnacg59804/01/2023, 12:47
230104-p1dgysah518Analysis
- max time kernel
302s - max time network
314s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
25/03/2024, 12:10
General
- Target from_r_techsupport_post_zfbprl.ps1
- Size 3KB
- Sample240325-pcfbmsfb49
- SHA256 2573edb9592715b7e0048056279d6d707c959fe815148f733e60b4eb0fca3aea
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\from_r_techsupport_post_zfbprl.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
__PSScriptPolicyTest_c1sezkv1.42s.ps1
memory/2320-13-0x000001D2DC5E0000-0x000001D2DC5FA000-memory.dmp
memory/2320-10-0x000001D2DC0E0000-0x000001D2DC0F0000-memory.dmp
memory/2320-11-0x000001D2DC0E0000-0x000001D2DC0F0000-memory.dmp
memory/2320-12-0x000001D2DC140000-0x000001D2DC150000-memory.dmp
memory/2320-9-0x00007FFD4EF90000-0x00007FFD4FA52000-memory.dmp
memory/2320-14-0x00007FFD4EF90000-0x00007FFD4FA52000-memory.dmp
memory/2320-15-0x000001D2DC0E0000-0x000001D2DC0F0000-memory.dmp
memory/2320-16-0x000001D2DC0E0000-0x000001D2DC0F0000-memory.dmp
memory/2320-17-0x000001D2DC780000-0x000001D2DC8F6000-memory.dmp
memory/2320-18-0x000001D2DCB10000-0x000001D2DCD1A000-memory.dmp
memory/2320-8-0x000001D2DC0B0000-0x000001D2DC0D2000-memory.dmp
memory/3272-27-0x00007FFD4EF90000-0x00007FFD4FA52000-memory.dmp
memory/3272-46-0x000002E0A4430000-0x000002E0A4440000-memory.dmp
memory/3272-30-0x000002E0BE980000-0x000002E0BEB42000-memory.dmp
memory/3272-28-0x000002E0A4430000-0x000002E0A4440000-memory.dmp
memory/3272-29-0x000002E0A4430000-0x000002E0A4440000-memory.dmp
memory/3272-47-0x000002E0A4430000-0x000002E0A4440000-memory.dmp
memory/3272-42-0x00007FFD4EF90000-0x00007FFD4FA52000-memory.dmp
memory/4888-33-0x000001CEE9D70000-0x000001CEE9D80000-memory.dmp
memory/4888-44-0x000001CEEB720000-0x000001CEEBC48000-memory.dmp
memory/4888-43-0x000001CEEA540000-0x000001CEEA586000-memory.dmp
memory/4888-32-0x000001CEE9D70000-0x000001CEE9D80000-memory.dmp
memory/4888-31-0x00007FFD4EF90000-0x00007FFD4FA52000-memory.dmp
memory/4888-50-0x00007FFD4EF90000-0x00007FFD4FA52000-memory.dmp
memory/4888-51-0x000001CEE9D70000-0x000001CEE9D80000-memory.dmp