Edit tour
Windows
Analysis Report
download.ps1
Overview
General Information
| Sample name: | download.ps1 |
| Analysis ID: | 1571746 |
| MD5: | 828e0cc3c14385d28606aca4c5edf657 |
| SHA1: | bc962c5c0d31e0e0c13c0c3505a53ec3d3251a25 |
| SHA256: | aef32c3cd1cd6bd44239ca9a75064cfa31fc0d582e33683c1c602559b7e107f8 |
| Tags: | KongTukeps1user-monitorsg |
| Infos: |  |
 | |
Detection
| Score: | 68 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected suspicious sample
Contains functionality to infect the boot sector
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Opens network shares
Powershell drops PE file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Classification
- System is w10x64
powershell.exe (PID: 1872 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLogo -E xecutionPo licy unres tricted -f ile "C:\Us ers\user\D esktop\dow nload.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 1928 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
check.exe (PID: 3276 cmdline: "C:\Users\ user\AppDa ta\Roaming \kbHYWyel\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - check.exe (PID: 3120 cmdline:
"C:\Users\ user\AppDa ta\Roaming \kbHYWyel\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) 
systeminfo.exe (PID: 3976 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD) - conhost.exe (PID: 4052 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 6712 cmdline:
C:\Windows \system32\ cmd.exe /c "wmic com putersyste m get manu facturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 3576 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WMIC.exe (PID: 3020 cmdline: wmic compu tersystem get manufa cturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785) 
WerFault.exe (PID: 4100 cmdline: C:\Windows \system32\ WerFault.e xe -u -p 3 120 -s 968 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
- check.exe (PID: 5596 cmdline:
"C:\Users\ user\AppDa ta\Roaming \kbHYWyel\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - check.exe (PID: 7100 cmdline:
"C:\Users\ user\AppDa ta\Roaming \kbHYWyel\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - systeminfo.exe (PID: 3724 cmdline:
systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD) - conhost.exe (PID: 7076 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 6636 cmdline:
C:\Windows \system32\ cmd.exe /c "wmic com putersyste m get manu facturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 3976 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 5672 cmdline:
wmic compu tersystem get manufa cturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - WerFault.exe (PID: 2952 cmdline:
C:\Windows \system32\ WerFault.e xe -u -p 7 100 -s 968 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
- check.exe (PID: 4128 cmdline:
"C:\Users\ user\AppDa ta\Roaming \kbHYWyel\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - check.exe (PID: 5536 cmdline:
"C:\Users\ user\AppDa ta\Roaming \kbHYWyel\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - systeminfo.exe (PID: 6016 cmdline:
systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD) - conhost.exe (PID: 4360 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 2856 cmdline:
C:\Windows \system32\ cmd.exe /c "wmic com putersyste m get manu facturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2044 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 6764 cmdline:
wmic compu tersystem get manufa cturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - WerFault.exe (PID: 7024 cmdline:
C:\Windows \system32\ WerFault.e xe -u -p 5 536 -s 101 2 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: frack113: | ||
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||