Overview
overview
7Static
static
3kl/Modules...ts.ps1
windows7-x64
3kl/Modules...ts.ps1
windows10-2004-x64
3kl/Modules...ts.ps1
windows7-x64
3kl/Modules...ts.ps1
windows10-2004-x64
3kl/Modules...ps1xml
windows7-x64
3kl/Modules...ps1xml
windows10-2004-x64
7kl/Modules...on.ps1
windows7-x64
3kl/Modules...on.ps1
windows10-2004-x64
3kl/Modules...ts.ps1
windows7-x64
3kl/Modules...ts.ps1
windows10-2004-x64
3kl/Modules...os.ps1
windows7-x64
3kl/Modules...os.ps1
windows10-2004-x64
3kl/Modules.../D.ps1
windows7-x64
3kl/Modules.../D.ps1
windows10-2004-x64
3kl/Modules.../D.ps1
windows7-x64
3kl/Modules.../D.ps1
windows10-2004-x64
3kl/Modules.../D.ps1
windows7-x64
3kl/Modules.../D.ps1
windows10-2004-x64
3kl/Modules...nt.ps1
windows7-x64
3kl/Modules...nt.ps1
windows10-2004-x64
3kl/Modules...ce.ps1
windows7-x64
3kl/Modules...ce.ps1
windows10-2004-x64
3kl/Modules...es.ps1
windows7-x64
3kl/Modules...es.ps1
windows10-2004-x64
3kl/Modules...rs.dll
windows7-x64
1kl/Modules...rs.dll
windows10-2004-x64
1kl/Modules...rs.dll
windows7-x64
1kl/Modules...rs.dll
windows10-2004-x64
1kl/Modules...ll.dll
windows7-x64
1kl/Modules...ll.dll
windows10-2004-x64
1kl/Modules...er.dll
windows7-x64
1kl/Modules...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Simple/Simple.Tests.ps1
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Simple/Simple.Tests.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.Format.ps1xml
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.Format.ps1xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.ps1
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Microsoft.PowerShell.Operation.Validation.Tests.ps1
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Microsoft.PowerShell.Operation.Validation.Tests.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example1.Diagnostics/Diagnos.ps1
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example1.Diagnostics/Diagnos.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example2.Diagnostics/1.0.1/D.ps1
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example2.Diagnostics/1.0.1/D.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example3.Diagnostics/1.1.1/D.ps1
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example3.Diagnostics/1.1.1/D.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example3.Diagnostics/2.0.1/D.ps1
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example3.Diagnostics/2.0.1/D.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
kl/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagement/MSFT_PackageManagement.ps1
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
kl/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagement/MSFT_PackageManagement.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
kl/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagementSource/MSFT_PackageManagementSource.ps1
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
kl/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagementSource/MSFT_PackageManagementSource.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
kl/Modules/PackageManagement/1.0.0.1/DSCResources/PackageManagementDscUtilities.ps1
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
kl/Modules/PackageManagement/1.0.0.1/DSCResources/PackageManagementDscUtilities.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
kl/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.ArchiverProviders.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
kl/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.ArchiverProviders.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
kl/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.CoreProviders.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
kl/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.CoreProviders.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
kl/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MetaProvider.PowerShell.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
kl/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MetaProvider.PowerShell.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
kl/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MsiProvider.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
kl/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MsiProvider.dll
Resource
win10v2004-20240802-en
General
-
Target
kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1
-
Size
759B
-
MD5
37037611b8d8035a889ff01694e0b5fe
-
SHA1
36266741b98e8efc5d68761d722bbad75824dc1a
-
SHA256
1edbabd2ab521a579cf66ae26657bb4c0aa19e37ca5728bca794f54aa6e6fd18
-
SHA512
a05c8b47429cb7ecc7f79a9ac11474d2b182e9a53fd49d49509a657acb959e7770e877eef3873f2a6dd33ae732bf0ada27e0d2eb16f1233a2b255f47ef3d0477
Malware Config
Signatures
-
pid Process 336 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 336 powershell.exe 336 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 336 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 336 wrote to memory of 232 336 powershell.exe 83 PID 336 wrote to memory of 232 336 powershell.exe 83 PID 232 wrote to memory of 4004 232 csc.exe 84 PID 232 wrote to memory of 4004 232 csc.exe 84
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\kl\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\Comprehensive.Tests.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m3qdia5b\m3qdia5b.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA3A2.tmp" "c:\Users\Admin\AppData\Local\Temp\m3qdia5b\CSC52BDE03B8B444E9843ECEAAA2E694E.TMP"3⤵PID:4004
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5621a7d983c84ab471427ef191870efb4
SHA141963ba89bfc7465d2c80fc5a9a008b3d3fd9238
SHA256cff66c9e807d0e6b854f3244309da864b5c6a532c9747926f4b11c242660634d
SHA512ee1d6ea40e1e44c0cd677f8127fe1344de00007a400c1a54847900f8031d4894ef5b693df126e81d42e7f86eb85c94703e633f687ab753a2df4e08c97ce9dabe
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD56519397af974cca0a7b24334faa14411
SHA1c1105db18ec0e1a66bc17960a66d02f0ba38ec81
SHA2563b399d051eeb5af7063a152e75268fc35a6eedaebe728db66fa0e882801b443b
SHA512db4afa0e043ceaff20bbfdd07451bb323f1b74aaa2f1fb4927bf21efcf6911c7e7082203044aefe0e0c83809f0d6e1b9e6ae648acab9933fdeab9e4268eb62f7
-
Filesize
652B
MD577093cdae8871a95a229459c3a37306b
SHA10d2dc1ff221f6edfbd4b4e856896de0b7b16643d
SHA256bfa1f6c89ea37689975e5430020241130c31f4873a43771843905c727011cceb
SHA512568337dd268d66dc781eb60cdf119e2fa59361ac9901c9224e584c567893da3fd0819eae2d2145ef1728a717bcf82b2f0fc0dd0171de4381d6c57552b6647031
-
Filesize
907B
MD5d98b32865e5bd9376502ce614141b7fa
SHA1673d622933fbdb9aaafaf847c3cb8f1ce4b18cbc
SHA2566d21e15bcaebe4b6461790fbe39381ef6dc736eec19a66e80ee15caf4680fe00
SHA51228f4ec12ba6b47af36e288a81de46ce017144416626c50c4266207f92ac5d4b532691e1ee5a3cf54abc0c567e5cd60fb3d3180e8829cdbfab98013d45377ddb0
-
Filesize
369B
MD5afe2c941e3109ba2a546ad9383f03f7f
SHA1789f746ed047ff8148b9ab0f6c903e88eeb0340c
SHA256fefb5145a94aa0f5cdeed17e8df54601cf6d7798dae26fe1f71431a9ba60027c
SHA51241807f4ef6db027f32e6d41d88122e628fe5c0129eb110fb16b4cb0b55ab0492f45ff87453decf5f468aab50e7c6863f6fd5714a8ac82edf3e8ea97c78f92a6e