Edit tour
Windows
Analysis Report
back.ps1
Overview
General Information
| Sample name: | back.ps1 |
| Analysis ID: | 1566089 |
| MD5: | a5b77ea033190c4d914caec05d0d3442 |
| SHA1: | a706128c4d0ebb2e1392ebc5bf72e6977802e86b |
| SHA256: | a8ef13f70701de206e5d946838605d299bb096caa6c149e70af25e938bed576a |
| Tags: | ps1usjjsjsj-com-nguser-JAMESWT_MHT |
| Infos: |  |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
AI detected suspicious sample
Deletes shadow drive data (may be related to ransomware)
Drops PE files to the document folder of the user
Found pyInstaller with non standard icon
Loading BitLocker PowerShell Module
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Powershell creates an autostart link
Powershell drops PE file
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
powershell.exe (PID: 3136 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLogo -E xecutionPo licy unres tricted -f ile "C:\Us ers\user\D esktop\bac k.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 6880 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
zed.exe (PID: 2260 cmdline: "C:\Users\ user\Docum ents\gogjo thegoat\pa yload\zed. exe" MD5: FAECB8128727E4D7B36E49B3161A2C9E) - zed.exe (PID: 3196 cmdline:
"C:\Users\ user\Docum ents\gogjo thegoat\pa yload\zed. exe" MD5: FAECB8128727E4D7B36E49B3161A2C9E) - powershell.exe (PID: 2064 cmdline:
powershell -Command "Disable-C omputerRes tore -Driv e C:\\" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 2192 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7120 cmdline:
powershell -Command "Enable-Co mputerRest ore -Drive C:\\" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 5056 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
vssadmin.exe (PID: 5432 cmdline: vssadmin d elete shad ows /for=C : /all /qu iet MD5: B58073DB8892B67A672906C9358020EC) - conhost.exe (PID: 5332 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
ChromeComboPack.exe (PID: 1780 cmdline: "C:\Users\ user\Docum ents\gogjo thegoat\pa yload\Chro meComboPac k.exe" MD5: 8FD73177DC4A6FCC03F8E0307960A488) - conhost.exe (PID: 4236 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - ChromeComboPack.exe (PID: 6860 cmdline:
"C:\Users\ user\Docum ents\gogjo thegoat\pa yload\Chro meComboPac k.exe" MD5: 8FD73177DC4A6FCC03F8E0307960A488) - taskkill.exe (PID: 6116 cmdline:
taskkill / F /IM chro me.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
- zed.exe (PID: 1336 cmdline:
C:\Users\u ser\Docume nts\gogjot hegoat\pay load\zed.e xe MD5: FAECB8128727E4D7B36E49B3161A2C9E) - zed.exe (PID: 7128 cmdline:
C:\Users\u ser\Docume nts\gogjot hegoat\pay load\zed.e xe MD5: FAECB8128727E4D7B36E49B3161A2C9E) - powershell.exe (PID: 7156 cmdline:
powershell -Command "Disable-C omputerRes tore -Driv e C:\\" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 6440 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 5932 cmdline:
powershell -Command "Enable-Co mputerRest ore -Drive C:\\" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7136 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - vssadmin.exe (PID: 5984 cmdline:
vssadmin d elete shad ows /for=C : /all /qu iet MD5: B58073DB8892B67A672906C9358020EC) - conhost.exe (PID: 6612 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- powershell.exe (PID: 4132 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -WindowSty le Hidden -File "C:\ Users\user \Documents \gogjotheg oat\payloa d\taskboy. ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 6084 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Christopher Peacock '@securepeacock', SCYTHE: | ||
| Source: | Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): | ||
| Source: | Author: frack113: | ||
| Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Source: | Author: frack113: | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||