a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_12_/Crystalizer.ps1
Size

53KB
MD5

b6a2296e8b10cd624e538e4d115344d2
SHA1

a121b8415406491326ff8a15af93fc8b6c1657d9
SHA256

13b35482d6f13a556d05c3eb00235ccc32138ae94f7d3fe3917081c35adc7925
SHA512

ad216d5308e80a366f6c28ec7a676b187971199c4d8c15b1b7511528c78768d588fb445f86ea2520e930f018bb9b51153b2bd9f39951ff04118e2e68e8634815
SSDEEP

768:wb1O/6RzqkLJTDPIXnSKNAN/4cApjyXywI+d55HNMdaTxZMaEugsLpgDfK/97cFI:wA/6TVPUnSkKgc8yiwT7HhVZMDeaEH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1912	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1912	powershell.exe
1912	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1912	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2292	1912	powershell.exe	31
PID 1912 wrote to memory of 2292	1912	powershell.exe	31
PID 1912 wrote to memory of 2292	1912	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$_12_\Crystalizer.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "1912" "860"
  2⤵
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259435901.txt

Filesize
1KB

MD5
a80ab9f69a1c4bdc1267765ba851f240

SHA1
48b145e921ae672cfee2f4f74b6e9c1d804ae5ad

SHA256
f35dafd8bc40ab6050716f6973041deabecaff8e0b61131e520b46c60a039595

SHA512
8f783bacda6d6917bd029e73cf505e1055d77b7225054f55699919c141969e92bdfff462d6e748161445d5b8b669c70636b0b7a4399b5effce07cbed1e96976d

Download Submit
memory/1912-10-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/1912-6-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1912-7-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/1912-8-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/1912-9-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/1912-4-0x000007FEF617E000-0x000007FEF617F000-memory.dmp

Filesize
4KB

Download
memory/1912-11-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/1912-12-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/1912-13-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/1912-5-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/1912-16-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/1912-17-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download