Analysis
-
max time kernel
73s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 09:23
Static task
static1
Behavioral task
behavioral1
Sample
xxx.ps1
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
xxx.ps1
-
Size
2.0MB
-
MD5
4e71954ab5a47de9f74938dc0cd3c84f
-
SHA1
781b4cffead59d083d301c7eec7d55250b5a4317
-
SHA256
3b8fc9046c06420b3382cf851595370e4bb75ad0330c44515ad6bedb286dbfc7
-
SHA512
3a44a383686308352a5499d21a30317c61ea8caa81145001af22f5de536a2f3e73da43fafca53696be3923e86bb8780e5b503c3e5f379c1407362fca3909cd80
-
SSDEEP
24576:bSgmuyXfET5YN3b2LLG1z/7E4/KpdMJczdsrbIm:biMSNKLq1zjAU
Score
3/10
Malware Config
Signatures
-
pid Process 1096 powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2812 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1096 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1096 wrote to memory of 2812 1096 powershell.exe 32 PID 1096 wrote to memory of 2812 1096 powershell.exe 32 PID 1096 wrote to memory of 2812 1096 powershell.exe 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xxx.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr AutoHotkey64.exe /sc minute /mo 2 /st 09:25 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2812
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {42541169-1E51-4193-AE7F-3E21DED17309} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]1⤵PID:1700