b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b.ps1
Size 286KB
Sample240706-b59jasvcqf
SHA256 b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b
MD5 97262b9ab8ad8845620910772285fde9
SHA1 5cc54f15048fc162ca2ad00516842f09db41bf43
SHA512 69bb86b29f2a167fd2ac5240218bef90f7982724c866b3476b6090f5ec519d23095b74b4f675bff0c84700e4e729b255ecfd2bde6b726c071ec81da5c122481f
SSDEEP 1536:h3EjSvrxQrgoc7I5eFgT7OQdjdlYG76p/zIOO5YM:O2vtQrO7I5eFgT7OQd0g6p/NO5YM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
2600	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2928	powershell.exe
2928	powershell.exe
2928	powershell.exe
2600	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2600	2928	powershell.exe	30
PID 2928 wrote to memory of 2600	2928	powershell.exe	30
PID 2928 wrote to memory of 2600	2928	powershell.exe	30

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\zwvm4rur.pue.ps1" -message "[PROLIV] VM DETECTED (BIOS) [ ! ]"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 3776433453ca52ba7f57b9f6cec13c3961be7f77fb5f6ece2cd2e15ca9a67d85
MD5 e471d7eb2770dc6da506533b3e79b8cd
SHA1 52db59160eb084ce1db7b63009b0fd04d9fdbc54
SHA512 39e5034733bf4da01e99f5bebc01632d0b12d377e52424c68c2b46df1d4098bd17f81876fb3ebb64b646d7a2bb25b6877d284a64db1669ceb6fbc4d0be7f8cda
SSDEEP 96:YAqqCZM8xnqvsqvJCwoBAqqCZM8xnqvsEHyqvJCworo55mQHNS7qnXlUVs:obFUofbFAHnoromAS7qnr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2928-4-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Download

memory/2928-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

Download

memory/2928-5-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Download

memory/2928-8-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download

memory/2928-7-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download

memory/2928-9-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download

memory/2928-10-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download

memory/2928-11-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download

memory/2928-17-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download