bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad

Analysis

max time kernel
104s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2025, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps_z.ps1
Size 774B
Sample250321-xtargszpv8
SHA256 bb67fa07897b73aca77311e4d23bbbbe496e8570338f36305704e487034fd0ad
MD5 af90352dcdeb09d4a19ed975923ed038
SHA1 aa9535646b0cc8ea29fd85bd78fca8721651b299
SHA512 7bab6c3d5c5365a3466175137a1dca92baa092c59fc566b81d582fbe236a14ff0e0f6ce08b4528b9237395b58be530e97ad6cbbeaf22926044b581cc264578ea
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3716	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3716	powershell.exe
3716	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2592	3716	powershell.exe	86
PID 3716 wrote to memory of 2592	3716	powershell.exe	86
PID 2592 wrote to memory of 5716	2592	csc.exe	87
PID 2592 wrote to memory of 5716	2592	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps_z.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\znjuun5f\znjuun5f.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F92.tmp" "c:\Users\Admin\AppData\Local\Temp\znjuun5f\CSCC21D281D2763411F8A7DA46EBC0DFEE.TMP"
    3⤵
    PID:5716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES6F92.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6F92.tmp
Size 1KB
SHA256 503a5ddd8d8112999a45fdd87640ca1c16bc02e264a925e36e80a56052a06400
MD5 da63458425c902b0ec12abd294f3c03a
SHA1 51f35a3123bedb8ae0f4ac3cb18977f23a2b73f1
SHA512 7624c704678b8914f3fdd66e3290874c13ec2bf69a7d1d955476a5867c00a994921dc9237c7199e4fdcc3b138128bcf4ee583cc32c06d05c4ad76222d3785d11
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_surtfzbk.0qf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_surtfzbk.0qf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

znjuun5f.dll

Path C:\Users\Admin\AppData\Local\Temp\znjuun5f\znjuun5f.dll
Size 3KB
SHA256 261bbd10c1d422004184152747c52bd841752091bff493d7291e42094d40eb91
MD5 939485d6eb861b65995af4d25b8d37ee
SHA1 f378fbbd63ff27402ff4f076125cd24532670e51
SHA512 93657c6d0504997aa1aae411eaf39275f3a854d9d15898ad6ea608f2698c0de201030b56de1fbf98e2c9a900a9d816f705f538b4a3c234b31fc3354cdfd11450
MD5 SHA1 SHA512

Submit Download

CSCC21D281D2763411F8A7DA46EBC0DFEE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\znjuun5f\CSCC21D281D2763411F8A7DA46EBC0DFEE.TMP
Size 652B
SHA256 5fd06dd9aa3df7ea35360749e92cba0a19e1608d8a9076e1adde5bfca2998227
MD5 044d4fb9a50c74d222b50936a81c7645
SHA1 b61586e2461e29ec8a16174a078070bbbe7d22ba
SHA512 023c318529acca1f99b102ab5483619bb461f69efb60d96efc3ad493ce71bd79441d56eefadbafd604bfa54db7debcc15f11ba356f9d87fc9a7496d05f6fc272
MD5 SHA1 SHA512

Submit Download

znjuun5f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\znjuun5f\znjuun5f.0.cs
Size 455B
SHA256 0ac1698f8c7bfa8318fba310fd5e9e42697c3896f4fe0abb2979525166e880e8
MD5 b1688ab4e34fe42bdbe1e6a95f640868
SHA1 e8521f3db3baba9f4e77fe4a377d12ea996ef70b
SHA512 d2a8a72afc04d12ddc3b32dd824a123c911078bd247951f6b2fa36298f681f1a7601880d3114c00b528b553d8f50faa3bf53896acd95e4af9f685e22d7cea0f0
MD5 SHA1 SHA512

Submit Download

znjuun5f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\znjuun5f\znjuun5f.cmdline
Size 369B
SHA256 7d18dd09266934ec0d07546cace8c158d1b8fb66d75d3dde1be30d60a45ad8ff
MD5 ca3873d3857d293da4d1e9fde8932654
SHA1 d0769a48206cafcbdfd11c0248e0e9d581ddea82
SHA512 42c6899eadb140d94899b86a292f523c76e41dc2db134cd17e73665fac4bed8ffae5214161a41e50d6fc36d416a3024eb0707ed8ced37a9b43c975050ba30ea1
MD5 SHA1 SHA512

Submit Download

memory/3716-11-0x00007FF835CB0000-0x00007FF836771000-memory.dmp

Download

memory/3716-12-0x00007FF835CB0000-0x00007FF836771000-memory.dmp

Download

memory/3716-0-0x00007FF835CB3000-0x00007FF835CB5000-memory.dmp

Download

memory/3716-25-0x000001F46BE50000-0x000001F46BE58000-memory.dmp

Download

memory/3716-6-0x000001F46BD20000-0x000001F46BD42000-memory.dmp

Download

memory/3716-27-0x00007FF835CB0000-0x00007FF836771000-memory.dmp

Download

memory/3716-30-0x00007FF835CB0000-0x00007FF836771000-memory.dmp

Download