3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80

General

Target

haywood.ps1
Size

1.4MB
MD5

d87fcd8d2bf450b0056a151e9a116f72
SHA1

48cb6bdbe092e5a90c778114b2dda43ce3221c9f
SHA256

3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80
SHA512

61a636aca3d224dcd2ed29ca000cf0ecf88f51ffd7cb5182ea4599c9e889cb74b78824d93c7383457bd6d591506202527d44c6a15c93a9ab9cfc8230faddd04b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exe

pid process

3488 powershell.exe
3488 powershell.exe
3488 powershell.exe
3488 powershell.exe
1248 powershell.exe
1248 powershell.exe
1248 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3488 powershell.exe
Token: SeDebugPrivilege 1248 powershell.exe

pid	process
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe
1248	powershell.exe
1248	powershell.exe
1248	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

powershell.execsc.exepowershell.execsc.exe

description	pid	process	target process
PID 3488 wrote to memory of 1000	3488	powershell.exe	csc.exe
PID 3488 wrote to memory of 1000	3488	powershell.exe	csc.exe
PID 1000 wrote to memory of 608	1000	csc.exe	cvtres.exe
PID 1000 wrote to memory of 608	1000	csc.exe	cvtres.exe
PID 3488 wrote to memory of 1248	3488	powershell.exe	powershell.exe
PID 3488 wrote to memory of 1248	3488	powershell.exe	powershell.exe
PID 3488 wrote to memory of 1248	3488	powershell.exe	powershell.exe
PID 1248 wrote to memory of 2316	1248	powershell.exe	csc.exe
PID 1248 wrote to memory of 2316	1248	powershell.exe	csc.exe
PID 1248 wrote to memory of 2316	1248	powershell.exe	csc.exe
PID 2316 wrote to memory of 2624	2316	csc.exe	cvtres.exe
PID 2316 wrote to memory of 2624	2316	csc.exe	cvtres.exe
PID 2316 wrote to memory of 2624	2316	csc.exe	cvtres.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\haywood.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ci0dhwp5\ci0dhwp5.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9025.tmp" "c:\Users\Admin\AppData\Local\Temp\ci0dhwp5\CSC6E0F8A4A14E84B4C8393BE1D5C17DC33.TMP"
3⤵
PID:608

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\haywood.ps1"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qowywbno\qowywbno.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB89C.tmp" "c:\Users\Admin\AppData\Local\Temp\qowywbno\CSCD2ADA2E7871B48A7989EF361BF1C125F.TMP"
4⤵
PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9025.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB89C.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\ci0dhwp5\ci0dhwp5.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\qowywbno\qowywbno.dll

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ci0dhwp5\CSC6E0F8A4A14E84B4C8393BE1D5C17DC33.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ci0dhwp5\ci0dhwp5.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ci0dhwp5\ci0dhwp5.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qowywbno\CSCD2ADA2E7871B48A7989EF361BF1C125F.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qowywbno\qowywbno.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qowywbno\qowywbno.cmdline

Download Submit
memory/608-6-0x0000000000000000-mapping.dmp

Download
memory/1000-3-0x0000000000000000-mapping.dmp

Download
memory/1248-16-0x0000000007760000-0x0000000007761000-memory.dmp

Filesize
4KB

Download
memory/1248-22-0x0000000007F70000-0x0000000007F71000-memory.dmp

Filesize
4KB

Download
memory/1248-15-0x0000000006E70000-0x0000000006E71000-memory.dmp

Filesize
4KB

Download
memory/1248-32-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

Filesize
4KB

Download
memory/1248-17-0x0000000007680000-0x0000000007681000-memory.dmp

Filesize
4KB

Download
memory/1248-18-0x00000000077D0000-0x00000000077D1000-memory.dmp

Filesize
4KB

Download
memory/1248-13-0x0000000004860000-0x0000000004861000-memory.dmp

Filesize
4KB

Download
memory/1248-20-0x0000000007730000-0x0000000007731000-memory.dmp

Filesize
4KB

Download
memory/1248-21-0x0000000008130000-0x0000000008131000-memory.dmp

Filesize
4KB

Download
memory/1248-14-0x0000000007050000-0x0000000007051000-memory.dmp

Filesize
4KB

Download
memory/1248-23-0x000000000B6F0000-0x000000000B6F1000-memory.dmp

Filesize
4KB

Download
memory/1248-24-0x000000000AEA0000-0x000000000AEA1000-memory.dmp

Filesize
4KB

Download
memory/1248-11-0x0000000000000000-mapping.dmp

Download
memory/1248-12-0x0000000072F70000-0x000000007365E000-memory.dmp

Filesize
6.9MB

Download
memory/2316-25-0x0000000000000000-mapping.dmp

Download
memory/2624-28-0x0000000000000000-mapping.dmp

Download
memory/3488-10-0x0000027CE35D0000-0x0000027CE35D1000-memory.dmp

Filesize
4KB

Download
memory/3488-2-0x0000027CE3620000-0x0000027CE3621000-memory.dmp

Filesize
4KB

Download
memory/3488-1-0x0000027CE3470000-0x0000027CE3471000-memory.dmp

Filesize
4KB

Download
memory/3488-0-0x00007FFCD2DD0000-0x00007FFCD37BC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads