969d916fceda1849b5f31b4acae5b36fa2607607b711442e26b0b8460fa014c9

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

target.ps1
Size

147B
MD5

41af4ecabc203fecdf91680ad38c9d40
SHA1

cdc119a300de90c2284080cdae78ebd3ec915793
SHA256

969d916fceda1849b5f31b4acae5b36fa2607607b711442e26b0b8460fa014c9
SHA512

9f4fa2898c4e27b0b56b750fb12a413e7d3cfadb0e77c6d1038017f2561410d52fef943440b8a22e92eedc4264c14b10264eaf8a429d0b8cf507193a3f7ade13

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1704	powershell.exe
1704	powershell.exe
2288	powershell.exe
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2288	1704	powershell.exe	86
PID 1704 wrote to memory of 2288	1704	powershell.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command = New-Object System.Net.WebClient
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjrfohny.xbx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1704-28-0x000001CAF7CF0000-0x000001CAF7D00000-memory.dmp

Filesize
64KB

Download
memory/1704-12-0x000001CAF7CF0000-0x000001CAF7D00000-memory.dmp

Filesize
64KB

Download
memory/1704-0-0x000001CAF9EA0000-0x000001CAF9EC2000-memory.dmp

Filesize
136KB

Download
memory/1704-11-0x000001CAF7CF0000-0x000001CAF7D00000-memory.dmp

Filesize
64KB

Download
memory/1704-10-0x00007FF80A130000-0x00007FF80ABF1000-memory.dmp

Filesize
10.8MB

Download
memory/1704-32-0x00007FF80A130000-0x00007FF80ABF1000-memory.dmp

Filesize
10.8MB

Download
memory/2288-13-0x00007FF80A130000-0x00007FF80ABF1000-memory.dmp

Filesize
10.8MB

Download
memory/2288-23-0x0000019D9D880000-0x0000019D9D890000-memory.dmp

Filesize
64KB

Download
memory/2288-24-0x0000019D9D880000-0x0000019D9D890000-memory.dmp

Filesize
64KB

Download
memory/2288-27-0x00007FF80A130000-0x00007FF80ABF1000-memory.dmp

Filesize
10.8MB

Download