a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_12_/Crystalizer.ps1
Size

53KB
MD5

b6a2296e8b10cd624e538e4d115344d2
SHA1

a121b8415406491326ff8a15af93fc8b6c1657d9
SHA256

13b35482d6f13a556d05c3eb00235ccc32138ae94f7d3fe3917081c35adc7925
SHA512

ad216d5308e80a366f6c28ec7a676b187971199c4d8c15b1b7511528c78768d588fb445f86ea2520e930f018bb9b51153b2bd9f39951ff04118e2e68e8634815
SSDEEP

768:wb1O/6RzqkLJTDPIXnSKNAN/4cApjyXywI+d55HNMdaTxZMaEugsLpgDfK/97cFI:wA/6TVPUnSkKgc8yiwT7HhVZMDeaEH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2080	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	powershell.exe
2080	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2676	2080	powershell.exe	29
PID 2080 wrote to memory of 2676	2080	powershell.exe	29
PID 2080 wrote to memory of 2676	2080	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$_12_\Crystalizer.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "2080" "856"
  2⤵
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259414832.txt

Filesize
1KB

MD5
eab767f73b59d158a3848b8e7421d5d0

SHA1
71caab75626c015fead564ff2114fc9cff61647e

SHA256
a4f1098abf304adc00cfc2a78b67705c0511cc65fb501f4050e2324a66bd46fd

SHA512
1abf32bdb472e7be6882340417adf0a2e1c68846ad252969d3a11592a7e80c2c3f037904e844607a0d2fc050731f855a8239564b05eb0ab36024e343f13e6ea4

Download Submit
memory/2080-4-0x000007FEF666E000-0x000007FEF666F000-memory.dmp

Filesize
4KB

Download
memory/2080-7-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-8-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-6-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2080-10-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-9-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-5-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2080-11-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-12-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-15-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-16-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download