80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/10/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chymes.ps1
Size 51KB
Sample241020-cxhw2stdpb
SHA256 ec27c4d9af6cbacd93b645c053a5f4395c8c681e40fc203efd78fd139ed45c82
MD5 c44effc2e31c09744797d777080d6f2e
SHA1 8828388bd410c357e6b97cab00bb61519195f824
SHA512 2f40b4211743380d4126749b98e99301a879ebed0fc2d811d39c1c674ae2a0961d7a2044aa8755221e34617c482c83b444e3c54e9823de0688eec3f4a712e203
SSDEEP 1536:0MvcHJCJBjaqb4Dwjfrfo4zajOJRmaEgUys/Qarn:0M2KBr8DWrw0ajO/ma6y4QE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2348	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2348	powershell.exe
2348	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 988	2348	powershell.exe	31
PID 2348 wrote to memory of 988	2348	powershell.exe	31
PID 2348 wrote to memory of 988	2348	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Chymes.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "2348" "860"
  2⤵
  PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OutofProcReport259441977.txt

Path C:\Users\Admin\AppData\Local\Temp\OutofProcReport259441977.txt
Size 1KB
SHA256 5db8cfc5a9a82feed81bc03a20a4f565a4bb89a165ee4d338e8ec622e036cad2
MD5 b2e230b666f075a8bf19ba2d18e4a31c
SHA1 14a600c7cdd3653a1cff3c9221398fc9a4221c58
SHA512 10b4aa6f9641d6f4aa38560578690a2ef56e6748f8d2a56f82a3ceac00db636007785cb94d902602abab0f373fd644591de5cb449d017a4ade1fa01e72e92dd9
MD5 SHA1 SHA512

Submit Download

memory/2348-4-0x000007FEF56BE000-0x000007FEF56BF000-memory.dmp

Download

memory/2348-5-0x000000001B720000-0x000000001BA02000-memory.dmp

Download

memory/2348-6-0x0000000002240000-0x0000000002248000-memory.dmp

Download

memory/2348-7-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Download

memory/2348-8-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Download

memory/2348-9-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Download

memory/2348-10-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Download

memory/2348-13-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Download

memory/2348-14-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Download