159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
27s
max time network
120s
platform
windows10_x64
resource
win10
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/ProcessLTSReport.ps1
Size

26KB
MD5

eba14689c700d5ff7ec65a0ada255cd5
SHA1

348def56a79f15c85e14f3b6055935a4a7e6a62b
SHA256

40822cbb111ebb5d35d8629ffd4ecc86ad43391103b08315d434710167863037
SHA512

9bac89873521cf4cff5c23ba42ca16e85af376015e5cf8fd9ae81d71bc0d1f7e3b653a3da6c60b715057c35d6dcad09acd92672e48b3838dd015b68a05bd90cc

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
3104	powershell.exe
2208	powershell.exe
2208	powershell.exe
2208	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3104 powershell.exe
Token: SeDebugPrivilege 2208 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 3104 wrote to memory of 2208	3104	powershell.exe	powershell.exe
PID 3104 wrote to memory of 2208	3104	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
f290ff33102bc945b87b6871ce2f7cc4

SHA1
45f1664693c3d7c3b483897e69be3dac5618dd1a

SHA256
3f889f11dfa53455f75f8bad373308ba35e5016ede65b9785626322d131727a6

SHA512
f7f6e6ed9a03a5c31a904438736951698a335d508802cd9b0386e69df41671cdb9650d67d1d59aca30b3a4908d676dfb37bc7bff41f8796bef671152a5d6f57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
1bcfe0222014a52788618d086d320542

SHA1
e8ae935eccab3f54bc90ad176317ac421f5460e1

SHA256
ac0f9be4205f5d36670888d27ff9562e4a48c59271eb5b9b4b69d9af8ce5a910

SHA512
dff9a714e4e4b30f58fbc02c87ee7822b7c9f6693f86798e2f6859da8979e690b30677e4d31646ca76fd09a4824ba63f351e933fa6fd4251af722b5aa6dc3d5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
memory/2208-5-0x0000000000000000-mapping.dmp

Download
memory/2208-7-0x00007FFA44540000-0x00007FFA44F2C000-memory.dmp

Filesize
9.9MB

Download
memory/3104-0-0x00007FFA44540000-0x00007FFA44F2C000-memory.dmp

Filesize
9.9MB

Download
memory/3104-1-0x0000017870950000-0x0000017870951000-memory.dmp

Filesize
4KB

Download
memory/3104-2-0x0000017873370000-0x0000017873371000-memory.dmp

Filesize
4KB

Download
memory/3104-3-0x0000017870AB0000-0x0000017870AB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads