Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    22-10-2024 16:08

General

  • Target

    Kreditnotaens/Plettes.ps1

  • Size

    52KB

  • MD5

    ce0a682e2db6ee3b12ff901dd3bb16d8

  • SHA1

    d661a2f36066a9482a99c47c7773fc79161ea983

  • SHA256

    f73707d437fa4b1c7350b2eaf02faff3752d2267faa038e789fc3253aa08ae5e

  • SHA512

    75acea1f522ca924304dbaf44ce5732d04fe746c985edf2fe90e4de1ab036940f5f3a2cf76a0e8338f23014a1226de91af8b9c4aecfdb537a489b003b314f7c7

  • SSDEEP

    1536:wSzp6zgtCnDFOdY4ARI0LEvoaxTs7BdGiyn:wGp6zgtCnZOzARpLLaxw7BdGiK

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Kreditnotaens\Plettes.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "2240" "860"
      2⤵
        PID:2940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259480808.txt

      Filesize

      1KB

      MD5

      90426d4610ab3838a6d1fda80d85fccf

      SHA1

      adb758b7a0e87415e261054c40c6de5b681a9ae1

      SHA256

      b44d97573720f81e41694731667c0f55679d65d7db290947c1544d1227dd3202

      SHA512

      7cf09704673cc19deba9f628aed56d383f55edb41795626d556fc3d40850fa9472c28ed518033e0fa1775508f3e5ae89f29260cb99fd66deea0ab9367d539d44

    • memory/2240-4-0x000007FEF5F0E000-0x000007FEF5F0F000-memory.dmp

      Filesize

      4KB

    • memory/2240-5-0x000000001B720000-0x000000001BA02000-memory.dmp

      Filesize

      2.9MB

    • memory/2240-6-0x0000000002340000-0x0000000002348000-memory.dmp

      Filesize

      32KB

    • memory/2240-7-0x000007FEF5C50000-0x000007FEF65ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2240-8-0x000007FEF5C50000-0x000007FEF65ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2240-9-0x000007FEF5C50000-0x000007FEF65ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2240-11-0x000007FEF5C50000-0x000007FEF65ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2240-10-0x000007FEF5C50000-0x000007FEF65ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2240-12-0x000007FEF5C50000-0x000007FEF65ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2240-13-0x000007FEF5C50000-0x000007FEF65ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2240-16-0x000007FEF5C50000-0x000007FEF65ED000-memory.dmp

      Filesize

      9.6MB