Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-10-2024 01:35

General

  • Target

    Kontokurantens.ps1

  • Size

    50KB

  • MD5

    8a4da8bab6993bc24f8ba89b1a5035ba

  • SHA1

    0266616ebaff76b9027bdf4a52742bbb6d7dbf90

  • SHA256

    d19add8d848501931650d9c2f77d4519b15ffe2399a161dac88ea99c07f1b62d

  • SHA512

    1f604a65b0fb4543feab6eb9584aab3c47c5ebcabf251492c7be827e3c5d547f310ff05354bf30837fe8192be427c1855ec22783a0be14db15b40b1f05a13c50

  • SSDEEP

    1536:em3/0wJ5Bo29iuM2fkfAFr6+nw0JefyiwDs:/3/0EbiuRcot6Ocfyiwo

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Kontokurantens.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "2440" "864"
      2⤵
        PID:1624

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259431007.txt

      Filesize

      1KB

      MD5

      61c4c4e1cd43d4e86a39daf6feb0b559

      SHA1

      36ed6602dce7608c517ff73abe13b93311bf2d4d

      SHA256

      d73cc4dc091a6e01dcce8092b9adab8b3b988b9d4888dad487feb5c87a4610fa

      SHA512

      d4918c3f1b5189b68ee87032afb5451fb3292395267a30a22a09db9ca3527215232dd4b6a979f8d087be4a4bdbc29969e4b69bcee14026902710c714dbe037a7

    • memory/2440-4-0x000007FEF5FFE000-0x000007FEF5FFF000-memory.dmp

      Filesize

      4KB

    • memory/2440-5-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

      Filesize

      2.9MB

    • memory/2440-6-0x0000000002290000-0x0000000002298000-memory.dmp

      Filesize

      32KB

    • memory/2440-7-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2440-8-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2440-9-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2440-11-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2440-10-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2440-12-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2440-15-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

      Filesize

      9.6MB

    • memory/2440-16-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

      Filesize

      9.6MB