22b607cba20413cd4363dd69d04d7ecda694ce3cf514f965a74c3605c7793248

Resubmissions

01/06/2024, 22:49

240601-2rysrahf3t10

01/06/2024, 22:44

240601-2n2egahd8s8

01/06/2024, 22:34

240601-2g9ghahg4910

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
randomscript.ps1
Size 1KB
Sample240601-2rysrahf3t
SHA256 22b607cba20413cd4363dd69d04d7ecda694ce3cf514f965a74c3605c7793248
MD5 322d6110a033d0aadfc40c14b8668fc7
SHA1 810a4c158b6016c990ac9653e89a6e9af79d578c
SHA512 8e7c57e67c61ef9480f29232015a375718ae4defcf2603069da297dac0e4c4792f2f95371fda521c7fae8e077d38bdb34c5169d9fddc45064b37488a1d5e0699
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1280	powershell.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2548	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1280	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2548	1280	powershell.exe	29
PID 1280 wrote to memory of 2548	1280	powershell.exe	29
PID 1280 wrote to memory of 2548	1280	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\randomscript.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-4-0x000007FEF5BAE000-0x000007FEF5BAF000-memory.dmp

Download

memory/1280-5-0x000000001B170000-0x000000001B452000-memory.dmp

Download

memory/1280-6-0x00000000025D0000-0x00000000025D8000-memory.dmp

Download

memory/1280-7-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Download

memory/1280-8-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Download

memory/1280-9-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Download

memory/1280-10-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Download

memory/1280-11-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Download

memory/1280-12-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Download