Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-10-2024 01:37

General

  • Target

    Udlaanslofterne/Incuss.ps1

  • Size

    52KB

  • MD5

    f9bb610fdaf3e9fb1b4faa9ffddfab51

  • SHA1

    b0858761694b149c52d79d915d24d6d8fe161d14

  • SHA256

    9aaa17344e82a1134ff2b6c6e1eee773f703fd9f110b9b58fdfb87824f5def78

  • SHA512

    34f0f7ce7e4cbeb1ce0b699cfc97e5f6619dcd238fba0d9b30645d4fbc4ad5d97149355703568484b5110c621acd8eb1a0fb748359d4473cd7bf4b85235def54

  • SSDEEP

    768:y8ydwJkymbROj2OT/UOomJZlXFpMI7k9D1Og/7wVKlMhVaPCQc2jVT:y8ycmd0DUOoGXFZKcg8OmVuD5

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Udlaanslofterne\Incuss.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "1732" "880"
      2⤵
        PID:2480

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259434983.txt

      Filesize

      1KB

      MD5

      8e1771160d5205ed81d8c53763931a87

      SHA1

      cdc8d0c7d5d2e7c5acc7cab46ea61572de8478f2

      SHA256

      45394b3416efe83cda3b8c8b59bd75e58a4e645b032a186c9185f8c67251bbda

      SHA512

      f03c072ec0993853732c4e3a963b6d811b972ac79eeb8c5c6ca2e865a187a1fb4447f38b59902873ff9e983f908a4ff2b9d534ff2bcec3c6e4093261c951f1e3

    • memory/1732-9-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB

    • memory/1732-7-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB

    • memory/1732-6-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

      Filesize

      32KB

    • memory/1732-8-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB

    • memory/1732-10-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB

    • memory/1732-4-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

      Filesize

      4KB

    • memory/1732-11-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB

    • memory/1732-12-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB

    • memory/1732-13-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB

    • memory/1732-5-0x000000001B670000-0x000000001B952000-memory.dmp

      Filesize

      2.9MB

    • memory/1732-17-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB

    • memory/1732-16-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

      Filesize

      9.6MB