Windows
Analysis Report
powershell.exe
Overview
General Information
Detection
Score: | 21 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 80% |
Signatures
Classification
- System is w10x64
- powershell.exe (PID: 1836 cmdline:
"C:\Users\ user\Deskt op\powersh ell.exe" MD5: 9D8E30DAF21108092D5980C931876B7E) - conhost.exe (PID: 3540 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Click to jump to signature section
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Classification label: |
Source: | Mutant created: |
Source: | Static PE information: |
Source: | Key opened: | Jump to behavior |
Source: | Process created: | ||
Source: | Process created: |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Static PE information: |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Source: | Last function: |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 System Information Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 DLL Side-Loading | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | ReversingLabs |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1522749 |
Start date and time: | 2024-09-30 15:55:18 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 5m 51s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 12 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | powershell.exe |
Detection: | SUS |
Classification: | sus21.winEXE@2/0@0/0 |
EGA Information: | Failed |
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- VT rate limit hit for: powershell.exe
File type: | |
Entropy (8bit): | 5.393783193765634 |
TrID: |
|
File name: | powershell.exe |
File size: | 450'560 bytes |
MD5: | 9d8e30daf21108092d5980c931876b7e |
SHA1: | 7c04ec2377e32b3c7742f581f6c5437464dd2cf2 |
SHA256: | 3247bcfd60f6dd25f34cb74b5889ab10ef1b3ec72b4d4b3d95b5b25b534560b8 |
SHA512: | 02686cc52cb87adb192e378e4cbdd32bfaf02233321750c94d5d73a5b706ebe81daf6fbfba9e4d1ff1f437affa0606e8c868006fc7299d1b9eb5fb73d7e01f85 |
SSDEEP: | 6144:Sv5gN0KPKrsK9WWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:QsnPKriW2KXzJ4pdd3klnnWosPhnzq |
TLSH: | C6A44B87679412D1EC3EC035D82744520721BCBAD79197EF99D8F2390E712D0AE3EA6B |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...QO..QO..QO...O..QO...O..QO..RN..QO..UN..QO..POG.QO..PN..QO..TN..QO..\N..QO...O..QO..SN..QORich..QO................PE..d.. |
Icon Hash: | 6b595171192d243b |
Entrypoint: | 0x140004eb0 |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x140000000 |
Subsystem: | windows cui |
Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE |
Time Stamp: | 0x89A8E62 [Mon Jul 29 16:18:42 1974 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 10 |
OS Version Minor: | 0 |
File Version Major: | 10 |
File Version Minor: | 0 |
Subsystem Version Major: | 10 |
Subsystem Version Minor: | 0 |
Import Hash: | afacf6dc9041114b198160aab4d0ae77 |
Instruction |
---|
dec eax |
sub esp, 28h |
call 00007F46CCF09A50h |
dec eax |
add esp, 28h |
jmp 00007F46CCF09073h |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
jmp dword ptr [00007522h] |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
jmp dword ptr [0000761Eh] |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
nop word ptr [eax+eax+00000000h] |
dec eax |
cmp ecx, dword ptr [0000E751h] |
jne 00007F46CCF09272h |
dec eax |
rol ecx, 10h |
test cx, FFFFh |
jne 00007F46CCF09263h |
ret |
dec eax |
ror ecx, 10h |
jmp 00007F46CCF09497h |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
inc eax |
push ebx |
dec eax |
sub esp, 20h |
dec eax |
mov ebx, ecx |
dec eax |
lea ecx, dword ptr [0000E784h] |
call dword ptr [00007296h] |
mov eax, dword ptr [0000E710h] |
dec eax |
lea ecx, dword ptr [0000E771h] |
mov edx, dword ptr [0000ED03h] |
inc eax |
mov dword ptr [0000E6FBh], eax |
mov dword ptr [ebx], eax |
dec eax |
mov eax, dword ptr [00000058h] |
inc ecx |
mov ecx, 00000004h |
dec esp |
mov eax, dword ptr [eax+edx*8] |
mov eax, dword ptr [0000E6E0h] |
inc ebx |
mov dword ptr [ecx+eax], eax |
call dword ptr [0000725Eh] |
dec eax |
lea ecx, dword ptr [0000E73Fh] |
dec eax |
add esp, 20h |
pop ebx |
dec eax |
Programming Language: |
|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x119d4 | 0xb4 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x15000 | 0x57d88 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x14000 | 0xa08 | .pdata |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x6d000 | 0x3b8 | .reloc |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0xdc20 | 0x54 | .rdata |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0xbd10 | 0x28 | .rdata |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xbbd0 | 0x140 | .rdata |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0xc0b0 | 0x468 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x9c56 | 0xa000 | 4b420d9b7f0eee885baa036281fc86ef | False | 0.5060302734375 | data | 6.117950209374687 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0xb000 | 0x781c | 0x8000 | d3a58342384c044b9df29ff145bbcd36 | False | 0.30377197265625 | data | 4.1134931510635875 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x13000 | 0xf82 | 0x1000 | ab8aabeae04a78f205558af0fa2c0112 | False | 0.11669921875 | data | 1.7383246754874346 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.pdata | 0x14000 | 0xa08 | 0x1000 | 39cce6c7b20d8154bcb2f198d201632a | False | 0.32421875 | data | 3.4176248422972875 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.rsrc | 0x15000 | 0x57d88 | 0x58000 | fd9c32563fa2fea0c5fe7f4050684fe1 | False | 0.3489324396306818 | data | 5.3002119917429615 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.reloc | 0x6d000 | 0x3b8 | 0x1000 | 1019612b71d441505287a4da973cde27 | False | 0.169921875 | data | 1.965989543687137 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
MUI | 0x6ccb0 | 0xd8 | data | English | United States | 0.5277777777777778 |
RT_ICON | 0x15c48 | 0x2fbe | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States | 0.966372115856652 |
RT_ICON | 0x18c08 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | English | United States | 0.13096362777515352 |
RT_ICON | 0x1ce30 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.1795643153526971 |
RT_ICON | 0x1f3d8 | 0x1a68 | Device independent bitmap graphic, 40 x 80 x 32, image size 6720 | English | United States | 0.1933431952662722 |
RT_ICON | 0x20e40 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.2572701688555347 |
RT_ICON | 0x21ee8 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.3422131147540984 |
RT_ICON | 0x22870 | 0x6b8 | Device independent bitmap graphic, 20 x 40 x 32, image size 1680 | English | United States | 0.4197674418604651 |
RT_ICON | 0x22f28 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.5416666666666666 |
RT_ICON | 0x23408 | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 1152 | English | United States | 0.39451219512195124 |
RT_ICON | 0x23a70 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 512 | English | United States | 0.5524193548387096 |
RT_ICON | 0x23d58 | 0x1e8 | Device independent bitmap graphic, 24 x 48 x 4, image size 288 | English | United States | 0.6065573770491803 |
RT_ICON | 0x23f40 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128 | English | United States | 0.6486486486486487 |
RT_ICON | 0x24068 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | English | United States | 0.5748933901918977 |
RT_ICON | 0x24f10 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | English | United States | 0.7522563176895307 |
RT_ICON | 0x257b8 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | English | United States | 0.8248847926267281 |
RT_ICON | 0x25e80 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | English | United States | 0.6083815028901735 |
RT_ICON | 0x263e8 | 0x42028 | Device independent bitmap graphic, 256 x 512 x 32, image size 270336 | English | United States | 0.3222586324229961 |
RT_ICON | 0x68410 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.5345435684647303 |
RT_ICON | 0x6a9b8 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.6050656660412758 |
RT_ICON | 0x6ba60 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.6475409836065574 |
RT_ICON | 0x6c3e8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.6462765957446809 |
RT_GROUP_ICON | 0x23390 | 0x76 | data | English | United States | 0.7457627118644068 |
RT_GROUP_ICON | 0x6c850 | 0xbc | data | English | United States | 0.6063829787234043 |
RT_VERSION | 0x6c910 | 0x39c | OpenPGP Public Key | English | United States | 0.4642857142857143 |
RT_MANIFEST | 0x155a0 | 0x6a3 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.3719835197174809 |
DLL | Import |
---|---|
msvcrt.dll | _unlock, _lock, _commode, _fmode, _initterm, __setusermatherr, _cexit, _exit, exit, __set_app_type, __wgetmainargs, __CxxFrameHandler4, __dllonexit, _amsg_exit, _onexit, ?terminate@@YAXXZ, _vsnwprintf, _wcsicmp, _wcsnicmp, fclose, _wfopen, ??1type_info@@UEAA@XZ, wcstoul, wcschr, __uncaught_exception, _XcptFilter, memmove, memcpy, __CxxFrameHandler3, _CxxThrowException, ?what@exception@@UEBAPEBDXZ, ??1exception@@UEAA@XZ, ??0exception@@QEAA@AEBV0@@Z, ??0exception@@QEAA@AEBQEBDH@Z, ??0exception@@QEAA@AEBQEBD@Z, _callnewh, malloc, wcsncmp, wcsrchr, free, _purecall, ??3@YAXPEAX@Z, memcpy_s, ??_V@YAXPEAX@Z, __C_specific_handler, _itow_s, memset |
ATL.DLL | |
KERNEL32.dll | FindResourceExW, LCIDToLocaleName, UnmapViewOfFile, GetVersionExW, GetLocaleInfoW, GetUserDefaultUILanguage, GetLocaleInfoEx, GetSystemDefaultUILanguage, SearchPathW, LoadResource, GetTickCount, GetSystemTimeAsFileTime, FreeLibrary, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, SleepConditionVariableSRW, CreateFileMappingW, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, Sleep, IsWow64Process, GetCurrentThreadId, GetStartupInfoW, SetConsoleTitleW, FindFirstFileW, MapViewOfFile, GetFileType, CompareStringW, VerifyVersionInfoW, SetLastError, LoadLibraryExW, GetCurrentProcess, GetStdHandle, WriteFile, GetModuleHandleW, ExpandEnvironmentStringsW, GetModuleHandleExW, GetCurrentProcessId, VerSetConditionMask, GetModuleFileNameW, SetThreadUILanguage, K32GetModuleFileNameExW, GetProcAddress, SetErrorMode, FindClose, CreateFileW, GetFileAttributesW, OpenProcess, CreateToolhelp32Snapshot, WakeAllConditionVariable, FormatMessageW, LocalFree, WriteConsoleW, GetLastError, Process32NextW, Process32FirstW, CloseHandle |
OLEAUT32.dll | SysAllocString, SysFreeString, SafeArrayCreate, SafeArrayPutElement, SysStringLen, VariantClear |
ADVAPI32.dll | EventRegister, RegEnumKeyExW, RegOpenKeyExW, RegGetValueW, EventUnregister, EventWriteTransfer, RegCloseKey, RegQueryValueExW, EventSetInformation |
OLE32.dll | PropVariantClear, CoTaskMemAlloc, CoInitializeEx, CoUninitialize, CoCreateInstance, CoInitialize |
USER32.dll | LoadStringW |
mscoree.dll | CorBindToRuntimeEx |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
English | United States |
Click to jump to process
Click to jump to process
Click to jump to process
Target ID: | 2 |
Start time: | 09:56:15 |
Start date: | 30/09/2024 |
Path: | C:\Users\user\Desktop\powershell.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d72a0000 |
File size: | 450'560 bytes |
MD5 hash: | 9D8E30DAF21108092D5980C931876B7E |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | false |
Target ID: | 3 |
Start time: | 09:56:15 |
Start date: | 30/09/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff75da10000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |