6f35ab9d6aed8b8df1754149da79be5cdadae7b5366e8f2be46d9370f7e920c0

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ALL.ps1
Size

1KB
MD5

e10ccf0df3bde87d260ae2e058d21695
SHA1

7f8d334707d840b7e14a4cbd1c66af0926a32e2f
SHA256

b8ae83fe360ccdff72f83b7fe889c1639804c03d59452dfaeabacfa12e5b2830
SHA512

826b0e61d29a22c0ba07d8851f1fe54aa5afa7c73b973cc4ebfe84222f7f5806f58ee28b9374e03d0c45ca3a47216c71e5278e10bd1530dd6e57511bdace3058

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	2044	powershell.exe
6	2044	powershell.exe
8	2044	powershell.exe
9	2044	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	powershell.exe
1680	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1680	2044	powershell.exe	31
PID 2044 wrote to memory of 1680	2044	powershell.exe	31
PID 2044 wrote to memory of 1680	2044	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ALL.ps1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windo 1 -noexit -exec bypass -file C:\Users\Public\Microsoft.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
292dda3ed9c73d0aeedd8f245055d839

SHA1
b48ca53cbe80be07025241f2d3eb5c07c046e2ae

SHA256
49f5f24f023456c5a33ff23c770799fd0da2422996c1ecc01d4f89d6ffb72853

SHA512
55d2e3670ef8566aae77e90f60e48b1778f30fee26184979460fa17e95ac5f8cb1a6ec18b87464a3867ef6ceb95265b1a73dceee65164804a3b23fecd889a848

Download Submit
memory/1680-23-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-22-0x00000000022A4000-0x00000000022A7000-memory.dmp

Filesize
12KB

Download
memory/1680-21-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-8-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-9-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2044-10-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2044-11-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-12-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2044-13-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2044-14-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2044-4-0x000000001B290000-0x000000001B572000-memory.dmp

Filesize
2.9MB

Download
memory/2044-5-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/2044-7-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2044-6-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-24-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2044-25-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download