Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 02:13

General

  • Target

    kl/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1

  • Size

    759B

  • MD5

    37037611b8d8035a889ff01694e0b5fe

  • SHA1

    36266741b98e8efc5d68761d722bbad75824dc1a

  • SHA256

    1edbabd2ab521a579cf66ae26657bb4c0aa19e37ca5728bca794f54aa6e6fd18

  • SHA512

    a05c8b47429cb7ecc7f79a9ac11474d2b182e9a53fd49d49509a657acb959e7770e877eef3873f2a6dd33ae732bf0ada27e0d2eb16f1233a2b255f47ef3d0477

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\kl\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\Comprehensive.Tests.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:336
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m3qdia5b\m3qdia5b.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:232
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA3A2.tmp" "c:\Users\Admin\AppData\Local\Temp\m3qdia5b\CSC52BDE03B8B444E9843ECEAAA2E694E.TMP"
        3⤵
          PID:4004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESA3A2.tmp

      Filesize

      1KB

      MD5

      621a7d983c84ab471427ef191870efb4

      SHA1

      41963ba89bfc7465d2c80fc5a9a008b3d3fd9238

      SHA256

      cff66c9e807d0e6b854f3244309da864b5c6a532c9747926f4b11c242660634d

      SHA512

      ee1d6ea40e1e44c0cd677f8127fe1344de00007a400c1a54847900f8031d4894ef5b693df126e81d42e7f86eb85c94703e633f687ab753a2df4e08c97ce9dabe

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jglvvpm.lx5.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\m3qdia5b\m3qdia5b.dll

      Filesize

      3KB

      MD5

      6519397af974cca0a7b24334faa14411

      SHA1

      c1105db18ec0e1a66bc17960a66d02f0ba38ec81

      SHA256

      3b399d051eeb5af7063a152e75268fc35a6eedaebe728db66fa0e882801b443b

      SHA512

      db4afa0e043ceaff20bbfdd07451bb323f1b74aaa2f1fb4927bf21efcf6911c7e7082203044aefe0e0c83809f0d6e1b9e6ae648acab9933fdeab9e4268eb62f7

    • \??\c:\Users\Admin\AppData\Local\Temp\m3qdia5b\CSC52BDE03B8B444E9843ECEAAA2E694E.TMP

      Filesize

      652B

      MD5

      77093cdae8871a95a229459c3a37306b

      SHA1

      0d2dc1ff221f6edfbd4b4e856896de0b7b16643d

      SHA256

      bfa1f6c89ea37689975e5430020241130c31f4873a43771843905c727011cceb

      SHA512

      568337dd268d66dc781eb60cdf119e2fa59361ac9901c9224e584c567893da3fd0819eae2d2145ef1728a717bcf82b2f0fc0dd0171de4381d6c57552b6647031

    • \??\c:\Users\Admin\AppData\Local\Temp\m3qdia5b\m3qdia5b.0.cs

      Filesize

      907B

      MD5

      d98b32865e5bd9376502ce614141b7fa

      SHA1

      673d622933fbdb9aaafaf847c3cb8f1ce4b18cbc

      SHA256

      6d21e15bcaebe4b6461790fbe39381ef6dc736eec19a66e80ee15caf4680fe00

      SHA512

      28f4ec12ba6b47af36e288a81de46ce017144416626c50c4266207f92ac5d4b532691e1ee5a3cf54abc0c567e5cd60fb3d3180e8829cdbfab98013d45377ddb0

    • \??\c:\Users\Admin\AppData\Local\Temp\m3qdia5b\m3qdia5b.cmdline

      Filesize

      369B

      MD5

      afe2c941e3109ba2a546ad9383f03f7f

      SHA1

      789f746ed047ff8148b9ab0f6c903e88eeb0340c

      SHA256

      fefb5145a94aa0f5cdeed17e8df54601cf6d7798dae26fe1f71431a9ba60027c

      SHA512

      41807f4ef6db027f32e6d41d88122e628fe5c0129eb110fb16b4cb0b55ab0492f45ff87453decf5f468aab50e7c6863f6fd5714a8ac82edf3e8ea97c78f92a6e

    • memory/336-13-0x000001FB52400000-0x000001FB5242A000-memory.dmp

      Filesize

      168KB

    • memory/336-14-0x000001FB52400000-0x000001FB52424000-memory.dmp

      Filesize

      144KB

    • memory/336-0-0x00007FFE9E373000-0x00007FFE9E375000-memory.dmp

      Filesize

      8KB

    • memory/336-27-0x000001FB51F10000-0x000001FB51F18000-memory.dmp

      Filesize

      32KB

    • memory/336-12-0x00007FFE9E370000-0x00007FFE9EE31000-memory.dmp

      Filesize

      10.8MB

    • memory/336-11-0x00007FFE9E370000-0x00007FFE9EE31000-memory.dmp

      Filesize

      10.8MB

    • memory/336-1-0x000001FB51F20000-0x000001FB51F42000-memory.dmp

      Filesize

      136KB

    • memory/336-29-0x00007FFE9E370000-0x00007FFE9EE31000-memory.dmp

      Filesize

      10.8MB

    • memory/336-30-0x00007FFE9E370000-0x00007FFE9EE31000-memory.dmp

      Filesize

      10.8MB

    • memory/336-33-0x00007FFE9E370000-0x00007FFE9EE31000-memory.dmp

      Filesize

      10.8MB