Analysis
- max time kernel
93s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
06/07/2024, 01:44
Static task
static1
Behavioral task
behavioral1
Sample
b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b.ps1
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b.ps1
Resource
win10v2004-20240704-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b.ps1
- Size 286KB
- Sample240706-b59jasvcqf
- SHA256 b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b
- MD5 97262b9ab8ad8845620910772285fde9
- SHA1 5cc54f15048fc162ca2ad00516842f09db41bf43
- SHA512 69bb86b29f2a167fd2ac5240218bef90f7982724c866b3476b6090f5ec519d23095b74b4f675bff0c84700e4e729b255ecfd2bde6b726c071ec81da5c122481f
- SSDEEP 1536:h3EjSvrxQrgoc7I5eFgT7OQdjdlYG76p/zIOO5YM:O2vtQrO7I5eFgT7OQd0g6p/NO5YM
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 1 1460 powershell.exe 16 1356 powershell.exe 18 1356 powershell.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ipinfo.io 16 ipinfo.io -
pid Process 1460 powershell.exe 1356 powershell.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1460 powershell.exe 1460 powershell.exe 1356 powershell.exe 1356 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1460 powershell.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeIncreaseQuotaPrivilege 1356 powershell.exe Token: SeSecurityPrivilege 1356 powershell.exe Token: SeTakeOwnershipPrivilege 1356 powershell.exe Token: SeLoadDriverPrivilege 1356 powershell.exe Token: SeSystemProfilePrivilege 1356 powershell.exe Token: SeSystemtimePrivilege 1356 powershell.exe Token: SeProfSingleProcessPrivilege 1356 powershell.exe Token: SeIncBasePriorityPrivilege 1356 powershell.exe Token: SeCreatePagefilePrivilege 1356 powershell.exe Token: SeBackupPrivilege 1356 powershell.exe Token: SeRestorePrivilege 1356 powershell.exe Token: SeShutdownPrivilege 1356 powershell.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeSystemEnvironmentPrivilege 1356 powershell.exe Token: SeRemoteShutdownPrivilege 1356 powershell.exe Token: SeUndockPrivilege 1356 powershell.exe Token: SeManageVolumePrivilege 1356 powershell.exe Token: 33 1356 powershell.exe Token: 34 1356 powershell.exe Token: 35 1356 powershell.exe Token: 36 1356 powershell.exe Token: SeIncreaseQuotaPrivilege 1356 powershell.exe Token: SeSecurityPrivilege 1356 powershell.exe Token: SeTakeOwnershipPrivilege 1356 powershell.exe Token: SeLoadDriverPrivilege 1356 powershell.exe Token: SeSystemProfilePrivilege 1356 powershell.exe Token: SeSystemtimePrivilege 1356 powershell.exe Token: SeProfSingleProcessPrivilege 1356 powershell.exe Token: SeIncBasePriorityPrivilege 1356 powershell.exe Token: SeCreatePagefilePrivilege 1356 powershell.exe Token: SeBackupPrivilege 1356 powershell.exe Token: SeRestorePrivilege 1356 powershell.exe Token: SeShutdownPrivilege 1356 powershell.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeSystemEnvironmentPrivilege 1356 powershell.exe Token: SeRemoteShutdownPrivilege 1356 powershell.exe Token: SeUndockPrivilege 1356 powershell.exe Token: SeManageVolumePrivilege 1356 powershell.exe Token: 33 1356 powershell.exe Token: 34 1356 powershell.exe Token: 35 1356 powershell.exe Token: 36 1356 powershell.exe Token: SeIncreaseQuotaPrivilege 1356 powershell.exe Token: SeSecurityPrivilege 1356 powershell.exe Token: SeTakeOwnershipPrivilege 1356 powershell.exe Token: SeLoadDriverPrivilege 1356 powershell.exe Token: SeSystemProfilePrivilege 1356 powershell.exe Token: SeSystemtimePrivilege 1356 powershell.exe Token: SeProfSingleProcessPrivilege 1356 powershell.exe Token: SeIncBasePriorityPrivilege 1356 powershell.exe Token: SeCreatePagefilePrivilege 1356 powershell.exe Token: SeBackupPrivilege 1356 powershell.exe Token: SeRestorePrivilege 1356 powershell.exe Token: SeShutdownPrivilege 1356 powershell.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeSystemEnvironmentPrivilege 1356 powershell.exe Token: SeRemoteShutdownPrivilege 1356 powershell.exe Token: SeUndockPrivilege 1356 powershell.exe Token: SeManageVolumePrivilege 1356 powershell.exe Token: 33 1356 powershell.exe Token: 34 1356 powershell.exe Token: 35 1356 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1356 1460 powershell.exe 87 PID 1460 wrote to memory of 1356 1460 powershell.exe 87
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b3ed3f2bc5334e54ca8d6020d37da0764f123fa5717638229422bd95a028097b.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\q5sllmzf.wkq.ps1" -message "[PROLIV] VM DETECTED (GPU) [ ! ]"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 af27f64d2735a95512c720f64f5545ae91d39d10b497cc7b230745d35c4c4925
- MD5 4f2697ef19710289e9c2c45a2fdd7cd3
- SHA1 3e0674fc5ff652a89a42a76f7073e3ed06d0baf9
- SHA512 48221c871d990a2ea26eb1c36f8cf0ae623c9528a25cc41d3fd860bd02e1324e66e4906a081c6389896d6ad1350a3c701b9ff1ef7fb639e451fbcf9fe36e14fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ce5f7a6e682a47c886617685a62e92d7c5f4ff1d210561400e313a08e2b063ac
- MD5 7e6034832ab012f49e3d08896c5f99fd
- SHA1 30c1860e29146cef6e350d8a0a6a5a5e297086af
- SHA512 ecdad607fcefed6a6ea8950216a098e255fc0efe85cfc2294f2d5261c2d29ae0a74190b4d17f944edd62f186a45c2f25ea2b9db3f1e7711ce504ef8d0790de46
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b5vxjc5q.2f2.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\q5sllmzf.wkq.ps1
- Size 5KB
- SHA256 ca267047b8206c3ed72020088956437cddb9bc7817d71c6a4efdf0847bb3dfb3
- MD5 222fd3308a638e958c7a07657098b58b
- SHA1 7da2a0d1a30fd66b90181f6b58fdcc4fadeac5b1
- SHA512 a1ee301a05e58e2a2d5b74a8af3abb4b045248eb5f71e9a8488a475c7f641921ab5dcf5c1e6c47a0059fc7bbf928657697af5c16811896d8cbb6d17b313b3112
- SSDEEP 48:LK+b8tKH0nt1AymAo967GHCGa14RSa/YqGKsgiuy/GaRSOia/z:4dAAo96XB8YnR+U7
- MD5 SHA1 SHA512 SSDEEP