Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
run.ps1
Resource
win7-20240508-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
run.ps1
Resource
win10v2004-20240508-en
4 signatures
150 seconds
General
-
Target
run.ps1
-
Size
68B
-
MD5
17f5c792ca5dba4cf47a56982d7d4551
-
SHA1
f3d3684eefd70ffbe6e5cbc88031382bba443a6f
-
SHA256
ac0a469bd627fe912176f38dc0691f1159bdccc811899e79e22102d12325c097
-
SHA512
2dd27f46506b8351faecf2200e4ab05e1509fb5fcb010c1d338f08bb2224257978638851a50538546a796ed2861e759898fbdd1f7c23e1c6cc8880296e2f01fe
Score
3/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1732 powershell.exe 1732 powershell.exe 1732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1732 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
powershell.exedescription pid process target process PID 1732 wrote to memory of 2692 1732 powershell.exe rundll32.exe PID 1732 wrote to memory of 2692 1732 powershell.exe rundll32.exe PID 1732 wrote to memory of 2692 1732 powershell.exe rundll32.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" swprv.dll, #52⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-4-0x000007FEF608E000-0x000007FEF608F000-memory.dmpFilesize
4KB
-
memory/1732-5-0x000000001B5D0000-0x000000001B8B2000-memory.dmpFilesize
2.9MB
-
memory/1732-7-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmpFilesize
9.6MB
-
memory/1732-6-0x00000000027E0000-0x00000000027E8000-memory.dmpFilesize
32KB
-
memory/1732-8-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmpFilesize
9.6MB
-
memory/1732-9-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmpFilesize
9.6MB
-
memory/1732-10-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmpFilesize
9.6MB
-
memory/1732-11-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmpFilesize
9.6MB
-
memory/1732-12-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmpFilesize
9.6MB