1eb9e4d9431c70bfd18beb58430bc81724eaff21837dd1faf012c83921a6418b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bronchial.ps1
Size 53KB
Sample241009-blympa1gpb
SHA256 07214c3106b73ab3636312bb5dded94558e94ff987c2a7afd3b25d6f6ff70603
MD5 964ad8a70ae8d0d1460e36109c9e717c
SHA1 c6c17dec132a22c0da128abc21b47793996d9c86
SHA512 588dc5d099ded1d86d60b767c851fb8b5aeed8297a3e7d8dec013673e7f576758daa7adacc68e514f4cc5b950795ff1d14162b0996fc5c022512cfac77b39c37
SSDEEP 1536:0UQ5eKx/WJHbGssheX5PeqSmH8UdEHCxsewwM:HQ5eKxwHbG8e/q8UuCuxJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1900	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	powershell.exe
1900	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2608	1900	powershell.exe	32
PID 1900 wrote to memory of 2608	1900	powershell.exe	32
PID 1900 wrote to memory of 2608	1900	powershell.exe	32

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Bronchial.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "1900" "852"
  2⤵
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OutofProcReport259446460.txt

Path C:\Users\Admin\AppData\Local\Temp\OutofProcReport259446460.txt
Size 1KB
SHA256 7d17746b4c574064ede77901f6ae4012b7afbd66fc69f18d2dcbce371e093fa9
MD5 55b1688bf8694c270271ce08a3d8f973
SHA1 933c96ef3c5f5919913eda442a1aae70caaab55f
SHA512 69b5f88e090271bc119b5c02e672d7776640ba2294896953a1a959ea44cb02d998ba77527eee06d0d011df1c5d4bec2a5a50fec7cf2893c13d67f3e8cff4bd28
MD5 SHA1 SHA512

Submit Download

memory/1900-4-0x000007FEF62EE000-0x000007FEF62EF000-memory.dmp

Download

memory/1900-5-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Download

memory/1900-6-0x00000000027A0000-0x00000000027A8000-memory.dmp

Download

memory/1900-7-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Download

memory/1900-8-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Download

memory/1900-9-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Download

memory/1900-10-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Download

memory/1900-11-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Download

memory/1900-14-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Download

memory/1900-15-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Download