3264d09d3a398417226b7d346c2fc4757ffa445373763e2d7c2f18ef6edb2354

Analysis

max time kernel
64s
max time network
38s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Night_uac/Uac_stage.ps1
Size

435B
MD5

9c0b29cea5533806aee83f5c49fcf6cd
SHA1

659155db6497a1d5c1e6fb2dc40b16f63bf0e1db
SHA256

e442ae7d9792416c46c134c8587ac7bfd947a6062c4abe9b700f83a5274b72cc
SHA512

72e6b4b55a4c16c12408a46b668073d0b09d59a0d4bc0941a33dc6859af8f8358df224f07d7fd2de780945c503c46a7f5cf98e957e4031884e9d0ec497463def

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

2 1680 powershell.exe
3 1680 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1680 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1680 powershell.exe
2500 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1680 powershell.exe
Token: SeDebugPrivilege 2500 powershell.exe

flow	pid	process
2	1680	powershell.exe
3	1680	powershell.exe

pid	process
1680	powershell.exe

pid	process
1680	powershell.exe
2500	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1680 wrote to memory of 2500	1680	powershell.exe	powershell.exe
PID 1680 wrote to memory of 2500	1680	powershell.exe	powershell.exe
PID 1680 wrote to memory of 2500	1680	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Night_uac\Uac_stage.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" c:\Users\Admin\Music\Uac_main.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4f533299debb62f93b27ac3920ee0cb6

SHA1
a66889516e6f051cd06632388089d18dccac6b66

SHA256
fc441c91267b8236e1843e25e042083b818ce8aa407ff58a5569179a5f9c2cb1

SHA512
50fc418520510a246b2d303f91baf216716c21bbfc0651a85b8d5778c8fd3d80aeb034c9be86a0e04972faf92e64adb6b125acdb93d862e0387ed3d20330d443

Download Submit
memory/1680-7-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-6-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/1680-4-0x000007FEF588E000-0x000007FEF588F000-memory.dmp

Filesize
4KB

Download
memory/1680-8-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-9-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-10-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-11-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-12-0x000007FEF588E000-0x000007FEF588F000-memory.dmp

Filesize
4KB

Download
memory/1680-5-0x000000001B360000-0x000000001B642000-memory.dmp

Filesize
2.9MB

Download
memory/1680-21-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/2500-19-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/2500-20-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download