Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 11:40
Behavioral task
behavioral1
Sample
p.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
p.ps1
Resource
win10v2004-20240426-en
General
-
Target
p.ps1
-
Size
3KB
-
MD5
de0a2d4a5b8f316d6587a30da16063e2
-
SHA1
2c908516a15a6ffbb6668d111465a564cf97a608
-
SHA256
a07444d7955d03e97f1643050cca78054035d2edd4a7d59e4ffb700b2be3f991
-
SHA512
065287eab4fff87a1c91152d261cd7865bae933cf1565514653c5b57b5bf5e8c8dfd78b189f0c339976ee3e90a2713f587b1d524e4d4f798057f746dc6413980
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 14 3704 powershell.exe -
Processes:
powershell.exepowershell.exepid process 4808 powershell.exe 3704 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 4808 powershell.exe 4808 powershell.exe 3704 powershell.exe 3704 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4808 powershell.exe Token: SeDebugPrivilege 3704 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
powershell.exedescription pid process target process PID 4808 wrote to memory of 3704 4808 powershell.exe powershell.exe PID 4808 wrote to memory of 3704 4808 powershell.exe powershell.exe PID 4808 wrote to memory of 3704 4808 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\p.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD593678e82d776686aa54c42b8a98e6cbc
SHA1802939dfed99ac74814c4371388b204c5810241d
SHA256da32a79a8e04cbafb1c5980b3d6225f4705010df5eb45d464cd5bf6b642d7841
SHA5120b412a1e11c0639d72f6a58c661ecc43da021c010c4d1e66051c5a376ebab287480bbf663345c9bd2a79ec3a35a9788cf04d74d612449f76fe2c87576cd13520
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aiudk5b1.u5q.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3704-21-0x0000000005B30000-0x0000000005B96000-memory.dmpFilesize
408KB
-
memory/3704-48-0x00000000753E0000-0x0000000075B90000-memory.dmpFilesize
7.7MB
-
memory/3704-32-0x0000000005D40000-0x0000000006094000-memory.dmpFilesize
3.3MB
-
memory/3704-45-0x00000000753E0000-0x0000000075B90000-memory.dmpFilesize
7.7MB
-
memory/3704-44-0x00000000753E0000-0x0000000075B90000-memory.dmpFilesize
7.7MB
-
memory/3704-15-0x00000000753EE000-0x00000000753EF000-memory.dmpFilesize
4KB
-
memory/3704-16-0x0000000004D90000-0x0000000004DC6000-memory.dmpFilesize
216KB
-
memory/3704-17-0x00000000753E0000-0x0000000075B90000-memory.dmpFilesize
7.7MB
-
memory/3704-18-0x0000000005400000-0x0000000005A28000-memory.dmpFilesize
6.2MB
-
memory/3704-19-0x00000000753E0000-0x0000000075B90000-memory.dmpFilesize
7.7MB
-
memory/3704-20-0x0000000005360000-0x0000000005382000-memory.dmpFilesize
136KB
-
memory/3704-22-0x0000000005CD0000-0x0000000005D36000-memory.dmpFilesize
408KB
-
memory/3704-43-0x00000000753EE000-0x00000000753EF000-memory.dmpFilesize
4KB
-
memory/3704-33-0x00000000064A0000-0x00000000064BE000-memory.dmpFilesize
120KB
-
memory/3704-37-0x00000000753E0000-0x0000000075B90000-memory.dmpFilesize
7.7MB
-
memory/3704-34-0x0000000006590000-0x00000000065DC000-memory.dmpFilesize
304KB
-
memory/3704-35-0x0000000007280000-0x00000000078FA000-memory.dmpFilesize
6.5MB
-
memory/3704-36-0x00000000069E0000-0x00000000069FA000-memory.dmpFilesize
104KB
-
memory/4808-11-0x00007FFADBFD0000-0x00007FFADCA91000-memory.dmpFilesize
10.8MB
-
memory/4808-39-0x00007FFADBFD3000-0x00007FFADBFD5000-memory.dmpFilesize
8KB
-
memory/4808-40-0x00007FFADBFD0000-0x00007FFADCA91000-memory.dmpFilesize
10.8MB
-
memory/4808-1-0x0000026526F60000-0x0000026526F82000-memory.dmpFilesize
136KB
-
memory/4808-52-0x00007FFADBFD0000-0x00007FFADCA91000-memory.dmpFilesize
10.8MB
-
memory/4808-14-0x0000026540670000-0x000002654087A000-memory.dmpFilesize
2.0MB
-
memory/4808-13-0x00000265402E0000-0x0000026540456000-memory.dmpFilesize
1.5MB
-
memory/4808-12-0x00007FFADBFD0000-0x00007FFADCA91000-memory.dmpFilesize
10.8MB
-
memory/4808-49-0x0000026526F90000-0x0000026526FA0000-memory.dmpFilesize
64KB
-
memory/4808-0-0x00007FFADBFD3000-0x00007FFADBFD5000-memory.dmpFilesize
8KB