4a4bde620f7d6baf02442d09999d40123bfa471e99fcb53d3617132b678bb6cb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-es
resource tags

arch:x64arch:x86image:win7-20240729-eslocale:es-esos:windows7-x64systemwindows
submitted
17/02/2025, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sightfulness.ps1
Size

51KB
MD5

56df3fc2932793899317cfeb62d64449
SHA1

f9b092b5a1b1a127390596c69c45025c920958fc
SHA256

1ba02a55786e074d96e3fc4c252b9ec86d6c50b76121692680fde2b15881d4f2
SHA512

834b1bba8777a8b766e3214861ac9fc4850edb76ff9d225e01d79656dd373c206a2782ff4853ccb0c13e4271ac00733de2c46ed23e470007b3e480e8ed04cb3c
SSDEEP

1536:6VFbjdXj8k66WzJHjbDgYUpnZ3lZwb08G:SFb5okRWtHjbiZ/wgH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	powershell.exe
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2728	2416	powershell.exe	31
PID 2416 wrote to memory of 2728	2416	powershell.exe	31
PID 2416 wrote to memory of 2728	2416	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Sightfulness.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "2416" "892"
  2⤵
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259445560.txt

Filesize
1KB

MD5
d9fe3527708471efa39698b04c644e2b

SHA1
aed0d7bd10458d29638c16dbb3dd76aa3c941d1e

SHA256
5d8e022a4629179b615a688c7ecc543eac5d9b369421d29c6f234444dbd4b067

SHA512
bac9fb33bda4f4e97d4e0919cd4a4722d876dc16475ce8d12d2bdc8b11b9ddc9e52e7695f51af4d6f96bd5e56c90a3581cd138b5c0231e2030c66bccbb7ce210

Download Submit
memory/2416-11-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download
memory/2416-15-0x0000000002D90000-0x0000000002DDE000-memory.dmp

Filesize
312KB

Download
memory/2416-8-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-7-0x0000000001C30000-0x0000000001C3E000-memory.dmp

Filesize
56KB

Download
memory/2416-6-0x0000000001C10000-0x0000000001C18000-memory.dmp

Filesize
32KB

Download
memory/2416-12-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-13-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-4-0x000007FEF61DE000-0x000007FEF61DF000-memory.dmp

Filesize
4KB

Download
memory/2416-9-0x0000000002C00000-0x0000000002C46000-memory.dmp

Filesize
280KB

Download
memory/2416-14-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-10-0x0000000002770000-0x000000000277A000-memory.dmp

Filesize
40KB

Download
memory/2416-16-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-17-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-19-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-18-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-23-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-22-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-5-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download