1dae2f77f68cd904437938939b9f20e92bef43e54b0886a4b13efd8599d8e2c7

Resubmissions

28-05-2024 19:09

240528-xt8crahe76 10

28-05-2024 18:35

240528-w8gmxage52 3

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_internal/tk/mkpsenc.ps1
Size

30KB
MD5

983c7b78f1a0ebacab8006d391a01fcd
SHA1

7ea37474ea039ed7a37bfdd7d76eae673e666283
SHA256

c5bdca3aba671f03dc4624ab5fd260490f5002491d6c619142ccf5a1a744528a
SHA512

a006ef9b7213e572f6fc540d1512a52c52fec44e3a07846de09662ae32b7191c5cf639798531847b39e4076bf9dd6314b6f5373065c04f4fef221185b39c3117
SSDEEP

768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

108 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

108 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 108 powershell.exe

pid	process
108	powershell.exe

pid	process
108	powershell.exe

description	pid	process
Token: SeDebugPrivilege	108	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_internal\tk\mkpsenc.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:108

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-4-0x000007FEF62CE000-0x000007FEF62CF000-memory.dmp

Filesize
4KB

Download
memory/108-5-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/108-7-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download
memory/108-8-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download
memory/108-6-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/108-9-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download
memory/108-10-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download
memory/108-11-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download