Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-10-2024 01:36

General

  • Target

    Melibiose.ps1

  • Size

    53KB

  • MD5

    1f737850c90e5d135b2a519df3ce86a4

  • SHA1

    3d539ea4291810b1191eb671d8369b0cfa6d6f1d

  • SHA256

    dbc22a96f5153282b6037375b64d01887dbf9b978dd5eada76eaba847d8e7a3f

  • SHA512

    677a27533f8505de074c2237fba524f250c6db2c5a02b9b89341a49cd49ea6ccca1126d5964de025414fcf2fac58aee798f2c5c1536ab80a8ada088f1fd85996

  • SSDEEP

    1536:PVYsfFw+Y9sUEAhh4Dp2UrjvFBnGOkrq3GyY6GBTU:dH97NNAhh4t2U3ZYarY6qTU

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Melibiose.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "2380" "860"
      2⤵
        PID:2708

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259447993.txt

      Filesize

      1KB

      MD5

      fd3cf3f5d42e6c434835e32a25b470fd

      SHA1

      0b5c07e07f97b9228e40c65afaac85e5d5501bf4

      SHA256

      761f2f30f8390053e0c0f793659b088dd75cae229164f0ba9976bd2049c5a7f3

      SHA512

      7078a04371699e666846efe5e2369e7eab106754c8c49042bd27161eb7cf6e688585049347ef34316fa6a11d71ecfaef4100f40f2287e0a47fc12d5e0dff583c

    • memory/2380-9-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2380-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

      Filesize

      32KB

    • memory/2380-7-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2380-8-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2380-10-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2380-4-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

      Filesize

      4KB

    • memory/2380-11-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2380-12-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2380-13-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2380-5-0x000000001B730000-0x000000001BA12000-memory.dmp

      Filesize

      2.9MB

    • memory/2380-17-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2380-16-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB