a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_12_/Crystalizer.ps1
Size

53KB
MD5

b6a2296e8b10cd624e538e4d115344d2
SHA1

a121b8415406491326ff8a15af93fc8b6c1657d9
SHA256

13b35482d6f13a556d05c3eb00235ccc32138ae94f7d3fe3917081c35adc7925
SHA512

ad216d5308e80a366f6c28ec7a676b187971199c4d8c15b1b7511528c78768d588fb445f86ea2520e930f018bb9b51153b2bd9f39951ff04118e2e68e8634815
SSDEEP

768:wb1O/6RzqkLJTDPIXnSKNAN/4cApjyXywI+d55HNMdaTxZMaEugsLpgDfK/97cFI:wA/6TVPUnSkKgc8yiwT7HhVZMDeaEH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2572	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2572	powershell.exe
2572	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2956	2572	powershell.exe	32
PID 2572 wrote to memory of 2956	2572	powershell.exe	32
PID 2572 wrote to memory of 2956	2572	powershell.exe	32

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$_12_\Crystalizer.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "2572" "856"
  2⤵
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259452436.txt

Filesize
1KB

MD5
3809f8d47853e7e2f8b062a8bb7a326c

SHA1
7d5890c342910b65799f65412be7e596fcd52d95

SHA256
ac297b57f66076aa8018ca91483b43ae4858e5ccbd212c7a8e0f381805c9ac2d

SHA512
e72e9d942afbb3be875bd91f4d8be0c881a6aca2b3394de7f9de11713fe5ea0cceb8ebe7d5cc3e6e8da8217c924396b2b48e9424916ab4dd98c031d4304b64bc

Download Submit
memory/2572-10-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-6-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/2572-5-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2572-8-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-9-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-4-0x000007FEF5F8E000-0x000007FEF5F8F000-memory.dmp

Filesize
4KB

Download
memory/2572-11-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-12-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-13-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-17-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-16-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-7-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download