Analysis

  • max time kernel
    16s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    24-10-2024 09:52

General

  • Target

    Alphabetism.ps1

  • Size

    52KB

  • MD5

    cd7e46b01dd5a4d151b79a64c053c906

  • SHA1

    de93ac5f7194e81de277bcafcd0deb8c00308e5a

  • SHA256

    575008f2a446a1a6c7817a571622b79935b1a07316a7276b7b4308f773b7284b

  • SHA512

    96d4892c094f415d3c635bb9e9493a6d1c7ada6ea97b9b6df6a23b548511181d24dd3fd27e49df497bdcc878fb0009d2710cebbd427558cf91f89a71aeb0afa9

  • SSDEEP

    768:JDHUVejEYd2f1a5HumqMFowogGttz4h4fxdr+208dgxUr7U1yc9QCBVuQiiX:ZHUVAHd2fU5OmqMmwo3tzjdix6M7QcqY

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Alphabetism.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "848" "856"
      2⤵
        PID:2480

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259520335.txt

      Filesize

      1KB

      MD5

      db387bd5d24d3382e0e0270c0dcc7fa8

      SHA1

      5111586d25b1810ebbe8911f69791b91c42bdacd

      SHA256

      e14707fb674e1bdcee1b85cc37d68c06db1401e21852c8920eb3f1fdd8e2461b

      SHA512

      f94680fcb438341870765c47eab221be289f1cf70e4b962930b1dbb57be412ef4d409caed5fc42742cbba39d61934bf6140b16eba1a2be13dd1a9e8611daf806

    • memory/848-4-0x000007FEF67AE000-0x000007FEF67AF000-memory.dmp

      Filesize

      4KB

    • memory/848-5-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

      Filesize

      2.9MB

    • memory/848-6-0x0000000002390000-0x0000000002398000-memory.dmp

      Filesize

      32KB

    • memory/848-7-0x000007FEF64F0000-0x000007FEF6E8D000-memory.dmp

      Filesize

      9.6MB

    • memory/848-8-0x000007FEF64F0000-0x000007FEF6E8D000-memory.dmp

      Filesize

      9.6MB

    • memory/848-9-0x000007FEF64F0000-0x000007FEF6E8D000-memory.dmp

      Filesize

      9.6MB

    • memory/848-10-0x000007FEF64F0000-0x000007FEF6E8D000-memory.dmp

      Filesize

      9.6MB

    • memory/848-11-0x000007FEF64F0000-0x000007FEF6E8D000-memory.dmp

      Filesize

      9.6MB

    • memory/848-14-0x000007FEF64F0000-0x000007FEF6E8D000-memory.dmp

      Filesize

      9.6MB