159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
17s
max time network
10s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/ProcessLTSReport.ps1
Size

26KB
MD5

eba14689c700d5ff7ec65a0ada255cd5
SHA1

348def56a79f15c85e14f3b6055935a4a7e6a62b
SHA256

40822cbb111ebb5d35d8629ffd4ecc86ad43391103b08315d434710167863037
SHA512

9bac89873521cf4cff5c23ba42ca16e85af376015e5cf8fd9ae81d71bc0d1f7e3b653a3da6c60b715057c35d6dcad09acd92672e48b3838dd015b68a05bd90cc

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

1468 powershell.exe
1468 powershell.exe
1468 powershell.exe
1948 powershell.exe
1948 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1468 powershell.exe
Token: SeDebugPrivilege 1948 powershell.exe

pid	process
1468	powershell.exe
1468	powershell.exe
1468	powershell.exe
1948	powershell.exe
1948	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1468 wrote to memory of 1948	1468	powershell.exe	powershell.exe
PID 1468 wrote to memory of 1948	1468	powershell.exe	powershell.exe
PID 1468 wrote to memory of 1948	1468	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
08785eac68967cb74da98401789316bd

SHA1
394d2e7131da3abc65f030c3daf0d6cad9fd0bf7

SHA256
2b31a9dcf7ceb947809410de88acc0cb4c551d16d7949edf1262f926a307a79a

SHA512
d119eeac7db6af24eba596e0656c75471305cabbc0a3d8cb24878600c5c2b1dc2dcc1a4ec82b530ce65943c1333b3b26a0ff0964cffdb8fde36cbc910614fa23

Download Submit
C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
cdffcba6da64bdbfa29c08390740d684

SHA1
3f74663820d463642117da168994f108ed0fce1f

SHA256
4664a34e802548e8b45978aa19f6b02dc1b9de2361414ced0270930fcfad35a3

SHA512
2289142c39d21eccafa40f835490625d9e3d244065f2bd1999d2ed75d48807fcbf2443a886e0e963d11f391f4fe7a5c1a69b1a3fd7869bcc281094866662eb6c

Download Submit
memory/1468-1-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1468-2-0x000000001AA80000-0x000000001AA81000-memory.dmp

Filesize
4KB

Download
memory/1468-3-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1468-4-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/1468-5-0x000000001B830000-0x000000001B831000-memory.dmp

Filesize
4KB

Download
memory/1468-6-0x000000001C6C0000-0x000000001C6C1000-memory.dmp

Filesize
4KB

Download
memory/1468-7-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1468-0-0x000007FEF6880000-0x000007FEF726C000-memory.dmp

Filesize
9.9MB

Download
memory/1948-9-0x0000000000000000-mapping.dmp

Download
memory/1948-13-0x000000001ACC0000-0x000000001ACC1000-memory.dmp

Filesize
4KB

Download
memory/1948-14-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/1948-15-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/1948-12-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/1948-11-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/1948-18-0x000000001B570000-0x000000001B571000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads