Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-10-2024 17:21

General

  • Target

    Night_uac/down.ps1

  • Size

    278B

  • MD5

    de07ecbd1be6e54daa4e8eaf6303b157

  • SHA1

    d5865ba74f03ccf7c03e27d1399e6b46e85f895e

  • SHA256

    ab12c751a1da5db32da6abb02fb8b24a873866b65ec45905db842877c7ff5c8d

  • SHA512

    e8bc8f9f272c3ba792779292dd5cc4f64f7092e63de5d58ebe4e13a755000ea2ec195eb7b20c973865728aa0d9bf198e6bf68118533de2f6664185b5e07501da

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops startup file 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Night_uac\down.ps1
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2436-4-0x000007FEF580E000-0x000007FEF580F000-memory.dmp

    Filesize

    4KB

  • memory/2436-5-0x000000001B750000-0x000000001BA32000-memory.dmp

    Filesize

    2.9MB

  • memory/2436-7-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

    Filesize

    9.6MB

  • memory/2436-6-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

    Filesize

    32KB

  • memory/2436-8-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

    Filesize

    9.6MB

  • memory/2436-9-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

    Filesize

    9.6MB

  • memory/2436-10-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

    Filesize

    9.6MB

  • memory/2436-11-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

    Filesize

    9.6MB

  • memory/2436-12-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

    Filesize

    9.6MB

  • memory/2436-13-0x000007FEF580E000-0x000007FEF580F000-memory.dmp

    Filesize

    4KB

  • memory/2436-14-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

    Filesize

    9.6MB

  • memory/2436-15-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

    Filesize

    9.6MB