Analysis
-
max time kernel
26s -
max time network
111s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
26-08-2020 00:07
Static task
static1
Behavioral task
behavioral1
Sample
haywood.ps1
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
haywood.ps1
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
haywood.ps1
-
Size
1.4MB
-
MD5
d87fcd8d2bf450b0056a151e9a116f72
-
SHA1
48cb6bdbe092e5a90c778114b2dda43ce3221c9f
-
SHA256
3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80
-
SHA512
61a636aca3d224dcd2ed29ca000cf0ecf88f51ffd7cb5182ea4599c9e889cb74b78824d93c7383457bd6d591506202527d44c6a15c93a9ab9cfc8230faddd04b
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3488 powershell.exe 3488 powershell.exe 3488 powershell.exe 3488 powershell.exe 1248 powershell.exe 1248 powershell.exe 1248 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3488 powershell.exe Token: SeDebugPrivilege 1248 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3488 wrote to memory of 1000 3488 powershell.exe 67 PID 3488 wrote to memory of 1000 3488 powershell.exe 67 PID 1000 wrote to memory of 608 1000 csc.exe 68 PID 1000 wrote to memory of 608 1000 csc.exe 68 PID 3488 wrote to memory of 1248 3488 powershell.exe 69 PID 3488 wrote to memory of 1248 3488 powershell.exe 69 PID 3488 wrote to memory of 1248 3488 powershell.exe 69 PID 1248 wrote to memory of 2316 1248 powershell.exe 71 PID 1248 wrote to memory of 2316 1248 powershell.exe 71 PID 1248 wrote to memory of 2316 1248 powershell.exe 71 PID 2316 wrote to memory of 2624 2316 csc.exe 72 PID 2316 wrote to memory of 2624 2316 csc.exe 72 PID 2316 wrote to memory of 2624 2316 csc.exe 72
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\haywood.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ci0dhwp5\ci0dhwp5.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9025.tmp" "c:\Users\Admin\AppData\Local\Temp\ci0dhwp5\CSC6E0F8A4A14E84B4C8393BE1D5C17DC33.TMP"3⤵PID:608
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\haywood.ps1"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qowywbno\qowywbno.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB89C.tmp" "c:\Users\Admin\AppData\Local\Temp\qowywbno\CSCD2ADA2E7871B48A7989EF361BF1C125F.TMP"4⤵PID:2624
-
-
-