Analysis
- max time kernel
35s - max time network
38s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
19/11/2024, 12:20
General
- Target kb2.ps1
- Size 726B
- Sample241119-phyeeawgnr
- SHA256 6905b4b4bc10a37ef57a613505702236938049bd3e05832cc916b35b1f5abdf3
Malware Config
Signatures
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\kb2.ps11⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Roaming\UWRyTewt\Set-up.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_l1neocrt.gf3.ps1
memory/3664-14-0x0000015672FE0000-0x0000015672FF4000-memory.dmp
memory/3664-16-0x00007FF989EC3000-0x00007FF989EC5000-memory.dmp
memory/3664-11-0x00007FF989EC0000-0x00007FF98A981000-memory.dmp
memory/3664-12-0x00007FF989EC0000-0x00007FF98A981000-memory.dmp
memory/3664-13-0x0000015672EB0000-0x0000015672ED6000-memory.dmp
memory/3664-0-0x00007FF989EC3000-0x00007FF989EC5000-memory.dmp
memory/3664-15-0x00007FF989EC0000-0x00007FF98A981000-memory.dmp
memory/3664-1-0x0000015672F90000-0x0000015672FB2000-memory.dmp
memory/3664-17-0x00007FF989EC0000-0x00007FF98A981000-memory.dmp
memory/3664-18-0x00007FF989EC0000-0x00007FF98A981000-memory.dmp
memory/3664-19-0x00007FF989EC0000-0x00007FF98A981000-memory.dmp
memory/3664-20-0x0000015673740000-0x0000015673752000-memory.dmp
memory/3664-21-0x0000015673000000-0x000001567300A000-memory.dmp
memory/3664-27-0x00007FF989EC0000-0x00007FF98A981000-memory.dmp