Analysis

  • max time kernel
    13s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-10-2024 14:02

General

  • Target

    Levitator/Exungulate.ps1

  • Size

    54KB

  • MD5

    0d2ce39822e9236a380f4d1d53550e93

  • SHA1

    8381b0e62708112dbfbed036650bf0667ec4476b

  • SHA256

    ed34db2a55a35c90b524d2448353eb73d28da7d7ff401477165c226ff25de9af

  • SHA512

    f365bb861db3fc6d29736b3f8c0377bb4f8318fff94bc96033ae208760082b529b8aea4cf79de9efa3608c79ac91fe57e19f26959831f621bba8816e1013afc3

  • SSDEEP

    1536:L3ZsYDoSFyAkhotYr3XpNhdrWlR7uDZy4k:DiYMSFyVoANpy4k

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Levitator\Exungulate.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "2344" "912"
      2⤵
        PID:2760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259559951.txt

      Filesize

      1KB

      MD5

      c9892eb1daf6c4337e8f24f86a9905a3

      SHA1

      4fa69503b7e972922a960ca676991b0e0e0cc559

      SHA256

      d309a88b1862eef70893e5dc1e8ad47c6de11901bf6d86d75c96c6563ee7c48a

      SHA512

      66c062f7f29d69a2bbe6c4da10d3c5d063f07220bb4950e3685067bf386f48d792236b67e7e06716b780cd6926620df02ebcd68ad5a7ffa6812b85c454104450

    • memory/2344-10-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-6-0x0000000001E70000-0x0000000001E78000-memory.dmp

      Filesize

      32KB

    • memory/2344-7-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-8-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-9-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-4-0x000007FEF5D9E000-0x000007FEF5D9F000-memory.dmp

      Filesize

      4KB

    • memory/2344-11-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-12-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-13-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-17-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-16-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-5-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

      Filesize

      2.9MB