8d09f0aa9a5d675e1f28dd31f6c982d33924c58d7b9b873d5cc90f3ddea5b491

Analysis

max time kernel
130s
max time network
131s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ps1006.ps1
Size

783KB
MD5

c538cd6483e9cf1510943d965f890777
SHA1

4dd880286916a54f6b0b3ed74e85135d1b2fc032
SHA256

8d09f0aa9a5d675e1f28dd31f6c982d33924c58d7b9b873d5cc90f3ddea5b491
SHA512

a13b2df4a31a587d54f1b5ae9d0d0aa2d89bf9562632b40730c741273811fb769003a8e6740035ef2dbf2740273f1a8b46d882b59983fa5dd885926d29e5976e
SSDEEP

12288:8ppYXT60Mv5a8kebcetZ3Aq74GA19Td1JplTmu5jP+D/43EeI1gZEtd14Q2fb5C:fXWZ5Pbcq92zjP+sjI10+r4Q2D5C

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow	pid	Process
7	2124	powershell.exe
9	2124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2124	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
2124	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2124	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	Process	procid_target
PID 2124 wrote to memory of 2484	2124	powershell.exe	32
PID 2124 wrote to memory of 2484	2124	powershell.exe	32
PID 2124 wrote to memory of 2484	2124	powershell.exe	32

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps1006.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kzlzjwlp.cmdline"
  2⤵
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-4-0x000007FEF589E000-0x000007FEF589F000-memory.dmp

Filesize
4KB

Download
memory/2124-5-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2124-6-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2124-7-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-8-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-9-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-10-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-11-0x000007FEF589E000-0x000007FEF589F000-memory.dmp

Filesize
4KB

Download
memory/2124-13-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-12-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-14-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download