Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27-07-2024 00:36
Static task
static1
Behavioral task
behavioral1
Sample
x.ps1
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
x.ps1
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
x.ps1
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
x.ps1
Resource
win11-20240709-en
windows11-21h2-x64
General
-
Target
x.ps1
-
Size
281KB
-
MD5
4fef7578494c3f065010b234da9e6d23
-
SHA1
715fda02ba7203162aee4f3a31cbb04f48f53e40
-
SHA256
cfafc9b2d6cbc65769074bab296c5fbacc676d298f7391a3ff787307eb1cbce0
-
SHA512
0e120078a74d43176a1959b7158408dedfef6afb8189852d28fcbc8ff30ac07825d7fd2d6bf957089115bae7a1cffadef39fba412b5137c969887592b5ae5fd2
-
SSDEEP
1536:EhqEjSvrxQrgoc7I5eFgT7OQdjdlYG76p/zIOO5Y4:G2vtQrO7I5eFgT7OQd0g6p/NO5Y4
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 4700 powershell.exe 5 4700 powershell.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ipinfo.io 2 ipinfo.io -
pid Process 4700 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4700 powershell.exe 4700 powershell.exe 4700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4700 powershell.exe Token: SeIncreaseQuotaPrivilege 4700 powershell.exe Token: SeSecurityPrivilege 4700 powershell.exe Token: SeTakeOwnershipPrivilege 4700 powershell.exe Token: SeLoadDriverPrivilege 4700 powershell.exe Token: SeSystemProfilePrivilege 4700 powershell.exe Token: SeSystemtimePrivilege 4700 powershell.exe Token: SeProfSingleProcessPrivilege 4700 powershell.exe Token: SeIncBasePriorityPrivilege 4700 powershell.exe Token: SeCreatePagefilePrivilege 4700 powershell.exe Token: SeBackupPrivilege 4700 powershell.exe Token: SeRestorePrivilege 4700 powershell.exe Token: SeShutdownPrivilege 4700 powershell.exe Token: SeDebugPrivilege 4700 powershell.exe Token: SeSystemEnvironmentPrivilege 4700 powershell.exe Token: SeRemoteShutdownPrivilege 4700 powershell.exe Token: SeUndockPrivilege 4700 powershell.exe Token: SeManageVolumePrivilege 4700 powershell.exe Token: 33 4700 powershell.exe Token: 34 4700 powershell.exe Token: 35 4700 powershell.exe Token: 36 4700 powershell.exe Token: SeIncreaseQuotaPrivilege 4700 powershell.exe Token: SeSecurityPrivilege 4700 powershell.exe Token: SeTakeOwnershipPrivilege 4700 powershell.exe Token: SeLoadDriverPrivilege 4700 powershell.exe Token: SeSystemProfilePrivilege 4700 powershell.exe Token: SeSystemtimePrivilege 4700 powershell.exe Token: SeProfSingleProcessPrivilege 4700 powershell.exe Token: SeIncBasePriorityPrivilege 4700 powershell.exe Token: SeCreatePagefilePrivilege 4700 powershell.exe Token: SeBackupPrivilege 4700 powershell.exe Token: SeRestorePrivilege 4700 powershell.exe Token: SeShutdownPrivilege 4700 powershell.exe Token: SeDebugPrivilege 4700 powershell.exe Token: SeSystemEnvironmentPrivilege 4700 powershell.exe Token: SeRemoteShutdownPrivilege 4700 powershell.exe Token: SeUndockPrivilege 4700 powershell.exe Token: SeManageVolumePrivilege 4700 powershell.exe Token: 33 4700 powershell.exe Token: 34 4700 powershell.exe Token: 35 4700 powershell.exe Token: 36 4700 powershell.exe Token: SeIncreaseQuotaPrivilege 4700 powershell.exe Token: SeSecurityPrivilege 4700 powershell.exe Token: SeTakeOwnershipPrivilege 4700 powershell.exe Token: SeLoadDriverPrivilege 4700 powershell.exe Token: SeSystemProfilePrivilege 4700 powershell.exe Token: SeSystemtimePrivilege 4700 powershell.exe Token: SeProfSingleProcessPrivilege 4700 powershell.exe Token: SeIncBasePriorityPrivilege 4700 powershell.exe Token: SeCreatePagefilePrivilege 4700 powershell.exe Token: SeBackupPrivilege 4700 powershell.exe Token: SeRestorePrivilege 4700 powershell.exe Token: SeShutdownPrivilege 4700 powershell.exe Token: SeDebugPrivilege 4700 powershell.exe Token: SeSystemEnvironmentPrivilege 4700 powershell.exe Token: SeRemoteShutdownPrivilege 4700 powershell.exe Token: SeUndockPrivilege 4700 powershell.exe Token: SeManageVolumePrivilege 4700 powershell.exe Token: 33 4700 powershell.exe Token: 34 4700 powershell.exe Token: 35 4700 powershell.exe Token: 36 4700 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\x.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a