74a179d75552a0768d8857d11e5e2c2481e416735291ac98332a504cdb60ba35

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
07-11-2024 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Clinopinacoidal/Upchuck.ps1
Size

54KB
MD5

282abf9b52e4ae72cead97089f079dad
SHA1

b3273b1372e49947e159b541ff829e7206e95650
SHA256

1f16b8c905f2d8f6fe3e3b6f08a8a18259d81cc7f918a7a61bb8f2954a704a20
SHA512

54ef11fc44dff9bf94d324b428c70b6e895b15300303b226c029cee86b8f1dc27bcdc8751c86d5250364c30384cafb85c145dee32337c6b992a55b72e2e5bf2b
SSDEEP

1536:24zKIs9vN0uSPLvogyzm1qY3ny+z2iCNLuSU0Q/4hxRzGvs6vh:RzqvYTOCqY3XXfeRgrJ

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	powershell.exe
2616	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1420	2616	powershell.exe	31
PID 2616 wrote to memory of 1420	2616	powershell.exe	31
PID 2616 wrote to memory of 1420	2616	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Clinopinacoidal\Upchuck.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "2616" "856"
  2⤵
  PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259443244.txt

Filesize
1KB

MD5
4e99eeb84a3625926c62d8aa07823a02

SHA1
b13bdd6e6b972fe55c6d26ce34b81437e1129bb0

SHA256
60ced94f8eaa623d0a2d7a292d05a181d252f628d47e3e78429a80c2253c7870

SHA512
8a447101c1a62687af1fa0af9fd26f3c370f6e41fbb43716a87e9da022f3f3eb06d411880733c454ef3437a3f17a6a9bc2f598bde6075523c90fe7a2376958d5

Download Submit
memory/2616-4-0x000007FEF56FE000-0x000007FEF56FF000-memory.dmp

Filesize
4KB

Download
memory/2616-5-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2616-6-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2616-7-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp

Filesize
9.6MB

Download
memory/2616-8-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp

Filesize
9.6MB

Download
memory/2616-9-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp

Filesize
9.6MB

Download
memory/2616-10-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp

Filesize
9.6MB

Download
memory/2616-13-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp

Filesize
9.6MB

Download
memory/2616-14-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp

Filesize
9.6MB

Download