a3c8884b793b10cd71ce232f59bd456100616f517ba28c8802cf8f1a03eb2beb

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Boligretssager/Skrinlgnings.ps1
Size

53KB
MD5

70e48952c940b791cc5d57c815cc66f2
SHA1

894f79ce1794d012252fde755e8743f5acc0e5c0
SHA256

1e9d85bae3e43aca86d6b4b4b16b0ebca713fd0dcbf6917b6915bbf644543949
SHA512

82c97bea8b231e6dfc8af045801641d95ee50e357c61962faaffb053f2971f10586927180db0fa7c62e09a325499a59aa791e4d20d5ceb963381a8f415991c72
SSDEEP

768:gtr3Difaie+aJiSZB1ccJTgyt6HI3hSEnsbx/S9lzN2/ylTbNXf:4D29ehzZYcJTrAIRlnM54lh2/Mpv

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2672	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2672	powershell.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2956	2672	powershell.exe	32
PID 2672 wrote to memory of 2956	2672	powershell.exe	32
PID 2672 wrote to memory of 2956	2672	powershell.exe	32

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Boligretssager\Skrinlgnings.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "2672" "852"
  2⤵
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259453541.txt

Filesize
1KB

MD5
aab6927b94a31c8133ecdfcb5525e826

SHA1
ea3e38797d74578072124809c00778550044f620

SHA256
7e2a5ed21db577abbb59d1db9fc2a30bbfa37146767287038cd0b1f8a9372850

SHA512
c514161c2113ea7fdffc22b577d5662606dbcf1ba710a3143e7193e1deba7015fde03ec8261e9e21a9fdb25a80c42d82dae5925f087c9dd339a1c2feb6bb69a2

Download Submit
memory/2672-10-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-6-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2672-8-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-7-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-9-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-4-0x000007FEF64EE000-0x000007FEF64EF000-memory.dmp

Filesize
4KB

Download
memory/2672-11-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-12-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-13-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-14-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-5-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2672-17-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/2672-18-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download