bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps_z.ps1
Size 774B
Sample250321-xtargszpv8
SHA256 bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad
MD5 af90352dcdeb09d4a19ed975923ed038
SHA1 aa9535646b0cc8ea29fd85bd78fca8721651b299
SHA512 7bab6c3d5c5365a3466175137a1dca92baa092c59fc566b81d582fbe236a14ff0e0f6ce08b4528b9237395b58be530e97ad6cbbeaf22926044b581cc264578ea
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2064	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2064	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2356	2064	powershell.exe	31
PID 2064 wrote to memory of 2356	2064	powershell.exe	31
PID 2064 wrote to memory of 2356	2064	powershell.exe	31
PID 2356 wrote to memory of 2060	2356	csc.exe	32
PID 2356 wrote to memory of 2060	2356	csc.exe	32
PID 2356 wrote to memory of 2060	2356	csc.exe	32

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps_z.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rcy4psfm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC13E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC13D.tmp"
    3⤵
    PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC13E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC13E.tmp
Size 1KB
SHA256 e73613c8d5584cf039173de24b0c70502e3e5ec91bc072ecd943f3d1e973d743
MD5 c76722abce86570eaaae237828867a41
SHA1 0e9326eec4415f95f7c6c6f8f141433e4ef5f603
SHA512 f00a78b77bb189982c536c064c3ad320141dff28c9110b73f72161f31c87160d372b8ff80a0e1f9ecd8db72bc2fd6a4c04e91da2560b93cce47987acda763c40
MD5 SHA1 SHA512

Submit Download

rcy4psfm.dll

Path C:\Users\Admin\AppData\Local\Temp\rcy4psfm.dll
Size 3KB
SHA256 f37d1a1dd73b2d4ad6b9e86a5c0d46cd54ec178bce8f55ca8a1edfe9d2cf4afc
MD5 2433df7345672694b0eb49c85adab1d7
SHA1 34c5c4e9c4c5dad590c9dee16f9c8d776cf78006
SHA512 aaf0122bf29e29d02cce8fe2e5742eee6f8a1961fd5577545ad5ac6e498a3679086267ecfa67e5d3f4327ced7bfc9cc3760c27f0f333a0b1ac6904d60480bf85
MD5 SHA1 SHA512

Submit Download

rcy4psfm.pdb

Path C:\Users\Admin\AppData\Local\Temp\rcy4psfm.pdb
Size 7KB
SHA256 c9b5aeaa8e134896e0eb5540e23423b4060ef49d8e579017b4f0315466886d60
MD5 46047569651999383c9010e2b56739df
SHA1 88a79e96022571fa45041bee85c6d6361c5a58ff
SHA512 0a5ea8cb65846614fd094d00297e50ccb409e9ff33825b6025f6712b34e975e608f8f89990ada190ffd67caae647042bcbe5fed2cb49f8a3dca8f5e212163045
SSDEEP 6:zz/BamfXllNS/uSg/11mllxrS/77715KZYXFSmCioGggksl/3YXBGQu+e0KWEi+:zz/H1W/GfSXS/pww3mqRi
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCC13D.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCC13D.tmp
Size 652B
SHA256 9abf570b255d4eb9e1839df983bd4173176dc136844c8e35dfeaecd4d253b271
MD5 dea1cb7be3c2c32655dc64e12957520e
SHA1 85fa37343ac24ecd18c3caacaeb213a67616d794
SHA512 0d5c49f2fcc8b051ccc661248013fff3aa58372cb02ceb97af1efe40f4c2465b8c42e420ce871e41fa9d4fb9be41e327516d2c53bd52d37a6b02406652465746
MD5 SHA1 SHA512

Submit Download

rcy4psfm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rcy4psfm.0.cs
Size 455B
SHA256 0ac1698f8c7bfa8318fba310fd5e9e42697c3896f4fe0abb2979525166e880e8
MD5 b1688ab4e34fe42bdbe1e6a95f640868
SHA1 e8521f3db3baba9f4e77fe4a377d12ea996ef70b
SHA512 d2a8a72afc04d12ddc3b32dd824a123c911078bd247951f6b2fa36298f681f1a7601880d3114c00b528b553d8f50faa3bf53896acd95e4af9f685e22d7cea0f0
MD5 SHA1 SHA512

Submit Download

rcy4psfm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rcy4psfm.cmdline
Size 309B
SHA256 96795a491c93da723e737ef831c66f242a6870a62015b4c7397298f24b8801aa
MD5 0fb0265fca9de6e541c60b3af28ca309
SHA1 dc373cea6911485591d1369e1bb3a58396e46f1f
SHA512 29bab53cf602275a13dcd61f2a981e170ed57bc6dc9fdcbb2e6053bd675700fbec5daf96ced25570f03a678c2ae88019c3935273301da49ad3dd725702308927
MD5 SHA1 SHA512

Submit Download

memory/2064-10-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2064-11-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2064-4-0x000007FEF617E000-0x000007FEF617F000-memory.dmp

Download

memory/2064-9-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2064-8-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2064-7-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2064-6-0x0000000002220000-0x0000000002228000-memory.dmp

Download

memory/2064-27-0x0000000002960000-0x0000000002968000-memory.dmp

Download

memory/2064-5-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Download

memory/2064-30-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2356-17-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2356-25-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download