Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2025, 06:02

General

  • Target

    Pericenter.ps1

  • Size

    53KB

  • MD5

    2d7a9b17a981757aeb3b8945b15bb897

  • SHA1

    7c27d9e5ce5ec9dfc5f13985769ca91698980e2a

  • SHA256

    7c7023149ea38184f67f040b8fac8f56804e7a84886678e7df8409354d3b0b7d

  • SHA512

    83370533553f6f55c644fc3b203c1e7e3572c69bc570776f0fbe79c146174fdfd3a037cf54c943222fd07d72fb0ac466b9154753adf4c5314a91ebfdbd8b2efe

  • SSDEEP

    1536:9pVgd3Kz6PAoQUUCuqfG2F9M15qJ3hLafjHcmM:9qKO4cnN59M15Ogg

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Pericenter.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "2428" "856"
      2⤵
        PID:2228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259438462.txt

      Filesize

      1KB

      MD5

      ae6f75a0870c4a893f566ed3add8374f

      SHA1

      085be2a2c3c921af54fee1b90a113b6480abc1c9

      SHA256

      9e2d13c337c913632e24b2d0e2689e475b8b4991815064e63f09c5008d8af9ba

      SHA512

      f3ca97c408122cf22271f3fca517137c605355ded4eac30cf269d577ef7babc2d411c16d552616630d9ab19986acadd4caefd7b83a1a7dbf67e1bf850cc91450

    • memory/2428-10-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-5-0x000000001B6B0000-0x000000001B992000-memory.dmp

      Filesize

      2.9MB

    • memory/2428-7-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-8-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-11-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-4-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

      Filesize

      4KB

    • memory/2428-9-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-12-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-13-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-14-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

      Filesize

      32KB

    • memory/2428-17-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2428-18-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

      Filesize

      9.6MB