Overview
overview
3Static
static
1155绿色�...��.url
windows7-x64
1155绿色�...��.url
windows10-2004-x64
1drupal-6.1...ap.ps1
windows7-x64
3drupal-6.1...ap.ps1
windows10-2004-x64
3drupal-6.1...on.ps1
windows7-x64
3drupal-6.1...on.ps1
windows10-2004-x64
3drupal-6.1...le.ps1
windows7-x64
3drupal-6.1...le.ps1
windows10-2004-x64
3drupal-6.1...rm.ps1
windows7-x64
3drupal-6.1...rm.ps1
windows10-2004-x64
3drupal-6.1...ll.ps1
windows7-x64
3drupal-6.1...ll.ps1
windows10-2004-x64
3drupal-6.1...le.ps1
windows7-x64
3drupal-6.1...le.ps1
windows10-2004-x64
3drupal-6.1...il.ps1
windows7-x64
3drupal-6.1...il.ps1
windows10-2004-x64
3drupal-6.1...le.ps1
windows7-x64
3drupal-6.1...le.ps1
windows10-2004-x64
3drupal-6.1...me.ps1
windows7-x64
3drupal-6.1...me.ps1
windows10-2004-x64
3drupal-6.1...pc.ps1
windows7-x64
3drupal-6.1...pc.ps1
windows10-2004-x64
3drupal-6.1...cs.ps1
windows7-x64
3drupal-6.1...cs.ps1
windows10-2004-x64
3drupal-6.1...all.js
windows7-x64
3drupal-6.1...all.js
windows10-2004-x64
3drupal-6.1...hah.js
windows7-x64
3drupal-6.1...hah.js
windows10-2004-x64
3drupal-6.1...ete.js
windows7-x64
3drupal-6.1...ete.js
windows10-2004-x64
3drupal-6.1...tch.js
windows7-x64
3drupal-6.1...tch.js
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25-07-2024 20:32
Static task
static1
Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
drupal-6.19/includes/bootstrap.ps1
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
drupal-6.19/includes/bootstrap.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
drupal-6.19/includes/common.ps1
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
drupal-6.19/includes/common.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
drupal-6.19/includes/file.ps1
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
drupal-6.19/includes/file.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
drupal-6.19/includes/form.ps1
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
drupal-6.19/includes/form.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
drupal-6.19/includes/install.ps1
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
drupal-6.19/includes/install.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
drupal-6.19/includes/locale.ps1
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
drupal-6.19/includes/locale.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
drupal-6.19/includes/mail.ps1
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
drupal-6.19/includes/mail.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
drupal-6.19/includes/module.ps1
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
drupal-6.19/includes/module.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
drupal-6.19/includes/theme.ps1
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
drupal-6.19/includes/theme.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
drupal-6.19/includes/xmlrpc.ps1
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
drupal-6.19/includes/xmlrpc.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
drupal-6.19/includes/xmlrpcs.ps1
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
drupal-6.19/includes/xmlrpcs.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
drupal-6.19/install.js
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
drupal-6.19/install.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
drupal-6.19/misc/ahah.js
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
drupal-6.19/misc/ahah.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
drupal-6.19/misc/autocomplete.js
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
drupal-6.19/misc/autocomplete.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
drupal-6.19/misc/batch.js
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
drupal-6.19/misc/batch.js
Resource
win10v2004-20240709-en
General
-
Target
drupal-6.19/includes/theme.ps1
-
Size
68KB
-
MD5
f9a129404a7110048681b23be674c71f
-
SHA1
966cc74693fe0e1751e8eaa8b5c8918538378c1b
-
SHA256
fdfb36f62efac1f9edd07140030a1f6e09114ee6b7d7b9c6acdc5303d9499351
-
SHA512
4ba3b2e17cdb73dad491d51c344d74654a5b03d33190f2a72b68e0934e1ebec8bfd8b7f6f3b782bd3652482c9e7b365c10fe2911c4623c3c817b803c93acb09b
-
SSDEEP
768:qQbtgOU68zKX5H2naLOarqghWTIyOu9aFHhcElMSHlXTbOuy5iyac0mvcl:qQbKOU6yOOgLgdavceTCj5iyac0
Malware Config
Signatures
-
pid Process 1840 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1840 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1840 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\drupal-6.19\includes\theme.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840