52065ef4a6e7cd0dbf5e04c7131d43ba4e79e6dd1d0d3df6c2a4daf0acee5527

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-07-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QQ农场牧场源码包V4.0/upload/qqfarm/source/mc/mod/friend.ps1
Size

1KB
MD5

664f4374de654b30232a6596779b0e4b
SHA1

ed506f0715d05d9b64f49864a6840d8d7bd488b1
SHA256

8ba44e7d9e6186a80537201ffd516c14f97228f6a943c6a2e2ff1760e04379a6
SHA512

1fe5a539974d7823b4028e63803411d8e04ab00efb220d0431a6ec96bc84017ba2d3eb64009697c3c487c49eb3fc53fb05fc4cf3e060ba787ecd3b95b55d383c

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2424 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2424 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2424 powershell.exe

pid	process
2424	powershell.exe

pid	process
2424	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2424	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\QQ农场牧场源码包V4.0\upload\qqfarm\source\mc\mod\friend.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-4-0x000007FEF53FE000-0x000007FEF53FF000-memory.dmp

Filesize
4KB

Download
memory/2424-5-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2424-6-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2424-7-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2424-8-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2424-9-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2424-11-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2424-10-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download