Analysis

  • max time kernel
    96s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 11:35

General

  • Target

    2.ps1

  • Size

    257KB

  • MD5

    1782325a32c0d152d2fc5f936764096b

  • SHA1

    32708733721654fd7ce18a2cc5859404dd365b48

  • SHA256

    e1dd619f137db33a6223900a330af2c9bb58b55b01504f142a27a4f44880a3ca

  • SHA512

    592aa5ef0a6b9f746538e503d40c250122a166db9fbd37ce08607b210ecdb09d7b42c5ca898d4b7ff0b3544f202aa7a52b7704f148f66df38ae9c836468b56a4

  • SSDEEP

    6144:aRQRmeIR/ENCsOFAjL3vTV8MG0NsPSSzQw6ACnfRFG5jc:wXiL7XvLw6Ak6o

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" = C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3488
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\ZVRWWLCFPWDOBNVCDRSFZL.ps1'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3140

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    d28a889fd956d5cb3accfbaf1143eb6f

    SHA1

    157ba54b365341f8ff06707d996b3635da8446f7

    SHA256

    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

    SHA512

    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    5f63331227ca7a936f3f8e00a55e23f7

    SHA1

    f2d862ac9f687bcc563b726cd5afbaa5b8e55bc2

    SHA256

    c5555b383f8537fc41c39ea131d78bdb80228d6842f161accb1c94c3ea0e841d

    SHA512

    f6ab7b6d6b9c73c75512e09aac7ffb4fb787805d42ee7ffd35344874020e18226f2c108e8cdeffefe32b725324f8bff336847eaa80405c732cf0c45a15cb0bd2

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nlcorwcm.33i.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2100-34-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-33-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-49-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-1-0x0000018AA84D0000-0x0000018AA84F2000-memory.dmp

    Filesize

    136KB

  • memory/2100-11-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-28-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-29-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-30-0x00007FFF61233000-0x00007FFF61235000-memory.dmp

    Filesize

    8KB

  • memory/2100-31-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-32-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-12-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-0-0x00007FFF61233000-0x00007FFF61235000-memory.dmp

    Filesize

    8KB

  • memory/3488-22-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/3488-27-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/3488-24-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/3488-23-0x00007FFF61230000-0x00007FFF61CF1000-memory.dmp

    Filesize

    10.8MB