Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23-10-2024 13:33

General

  • Target

    Vesperkost.ps1

  • Size

    53KB

  • MD5

    e35283bacb62d15976b5841105b466a1

  • SHA1

    0203661c08ae261483cd9da1c21d7173f8ea329d

  • SHA256

    d6a7990b9c733d4ba3b1b0d2e5e42dfa2253b22fe345f4870bf24686c516788d

  • SHA512

    9a0fbd409e74472330f6ec78e453af0825704d3d1f132657b6f8f32f738d51dc70a4124edade7c0fe3c6cc48c6774f8d822d4207d7e5f0879ae386df3e9521e6

  • SSDEEP

    1536:aU2++zktjXZ1gOBaa9pa5LXX4goZUxnIJu+OEK5Nl:BjJ1gf9Ln4rOxnp+O5Nl

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Vesperkost.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "3028" "932"
      2⤵
        PID:2816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259454818.txt

      Filesize

      1KB

      MD5

      840851aadea043a437d4587497346611

      SHA1

      5a32c4f38e91b31f66d14ec5aa1c88859d3b1c3a

      SHA256

      417c3264e46196ef202a4f887439166a57f13a7033f35ce316d920df640d8733

      SHA512

      60742825f459f7c8a4c21b5b4f008cd5dd59c4784ed8281f1f955c27db7048e5f9b1f332e50367403b64481af8ea9dfc7667a18fb9e734604f7e3e4e50b27720

    • memory/3028-4-0x000007FEF63DE000-0x000007FEF63DF000-memory.dmp

      Filesize

      4KB

    • memory/3028-5-0x000000001B400000-0x000000001B6E2000-memory.dmp

      Filesize

      2.9MB

    • memory/3028-6-0x0000000002590000-0x0000000002598000-memory.dmp

      Filesize

      32KB

    • memory/3028-7-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

      Filesize

      9.6MB

    • memory/3028-8-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

      Filesize

      9.6MB

    • memory/3028-9-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

      Filesize

      9.6MB

    • memory/3028-10-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

      Filesize

      9.6MB

    • memory/3028-11-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

      Filesize

      9.6MB

    • memory/3028-12-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

      Filesize

      9.6MB

    • memory/3028-13-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

      Filesize

      9.6MB

    • memory/3028-16-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

      Filesize

      9.6MB