Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2025, 05:57

General

  • Target

    Pericenter.ps1

  • Size

    53KB

  • MD5

    2d7a9b17a981757aeb3b8945b15bb897

  • SHA1

    7c27d9e5ce5ec9dfc5f13985769ca91698980e2a

  • SHA256

    7c7023149ea38184f67f040b8fac8f56804e7a84886678e7df8409354d3b0b7d

  • SHA512

    83370533553f6f55c644fc3b203c1e7e3572c69bc570776f0fbe79c146174fdfd3a037cf54c943222fd07d72fb0ac466b9154753adf4c5314a91ebfdbd8b2efe

  • SSDEEP

    1536:9pVgd3Kz6PAoQUUCuqfG2F9M15qJ3hLafjHcmM:9qKO4cnN59M15Ogg

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Pericenter.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "2236" "856"
      2⤵
        PID:264

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259447335.txt

      Filesize

      1KB

      MD5

      4cc4a4cdd5d7bb51116b1943e83f17b3

      SHA1

      035a35ea21643cba0a578bd2ff0e9f3f01a44966

      SHA256

      425d89cdb2c9799363fc4b65bfa2a568954bddea0660fb58497d1c0d8a64f47b

      SHA512

      59ff4cbd41f0dcd8bf9db66544d4a028536a97621f60e6905cef03559fa2a59e911288568466531c1cb5342f94935156f904370c230d17d39c9febca205e6a13

    • memory/2236-10-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-6-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-8-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-9-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-7-0x0000000001DC0000-0x0000000001DC8000-memory.dmp

      Filesize

      32KB

    • memory/2236-4-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

      Filesize

      4KB

    • memory/2236-11-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-12-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-14-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-13-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-5-0x000000001B610000-0x000000001B8F2000-memory.dmp

      Filesize

      2.9MB

    • memory/2236-18-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

    • memory/2236-17-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB