Analysis
- max time kernel
120s - max time network
124s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
15/11/2024, 11:44
General
- Target Chromonemal.ps1
- Size 53KB
- Sample241115-nwdfqasphy
- SHA256 73a4a59e35863571281154449961ab2a81ff47c3baa341d7de100287a0043274
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Chromonemal.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2200" "908"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
OutofProcReport259461065.txt
memory/2200-13-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-15-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-6-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-8-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-9-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-10-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-11-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-4-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmp
memory/2200-7-0x00000000025F0000-0x00000000025F8000-memory.dmp
memory/2200-14-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmp
memory/2200-12-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-16-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-18-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-17-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-19-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-5-0x000000001B340000-0x000000001B622000-memory.dmp
memory/2200-22-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp
memory/2200-23-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp