159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
19s
max time network
20s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/Win8RC.TS.ps1
Size

10KB
MD5

9a71209914cf8447adb6a58604520eab
SHA1

23709fbf7314235d3a9eec2acb2514b963bca418
SHA256

7b98f9e1b4af442fb337f7059aeabfb27441da41d18822e7e2022220f5731d2e
SHA512

3407ab7a5f5a22df0c948f5da7d5b181fcd73efb953b9a835bcd626deb36a4095a6f1b82c4ddc6e28ce93a26452c926bfcc1346895addb84171f3b6d7c3cb891

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 1700 powershell.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

920 powershell.exe
1700 powershell.exe
1700 powershell.exe
1700 powershell.exe
1700 powershell.exe
1824 powershell.exe
1824 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 920 powershell.exe
Token: SeDebugPrivilege 1700 powershell.exe
Token: SeDebugPrivilege 1824 powershell.exe

flow	pid	process
6	1700	powershell.exe

pid	process
920	powershell.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
1824	powershell.exe
1824	powershell.exe

description	pid	process
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process	target process
PID 920 wrote to memory of 1700	920	powershell.exe	powershell.exe
PID 920 wrote to memory of 1700	920	powershell.exe	powershell.exe
PID 920 wrote to memory of 1700	920	powershell.exe	powershell.exe
PID 1700 wrote to memory of 1824	1700	powershell.exe	powershell.exe
PID 1700 wrote to memory of 1824	1700	powershell.exe	powershell.exe
PID 1700 wrote to memory of 1824	1700	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\Win8RC.TS.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy unrestricted -command C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095021\ProcessLTSReport.ps1
2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095021\LTSCleanup.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
5e60d6e146abf24776c50f414841ed3b

SHA1
ebce66cfbd4c08d0bdd08be2f70d1b404875e163

SHA256
a504c408c30879b852a6b253478ee27cd0f120ea5427f6bc4cd33326bf2278dd

SHA512
94fe3718721d44bd9da34b56715083c78ddc68005926ec1c392c4a7fe9a348cc607692d955b1367d433cbca5e8b254c3387351c1ac2e015094a654464976c122

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095021\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095021\Lts_amd64.dll
MD5
0bb6bdf5c6b40b753520c9b9cb96747f

SHA1
64cd0cf38065757a614ac093f1e3a715a970fea6

SHA256
70ea558e5e169505c5fdfd8a9d58dcecb47a73784a3075089304aa0805074b84

SHA512
b3cc8e4fe06f12f6308d1ef71811c9955a02c605f4f1326eb2144dd3ba75997103104e314ac0acc949cc31710fdae3f9dbe1c72b2a8ef87025bb31709746e677

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095021\Lts_x86.dll
MD5
b1cd3050f7241e4a238f1c08766df4c8

SHA1
b2590f4ad227a852da9a84e9095e74dc545b3bd1

SHA256
146047bd5e4680263060291694fb1ac74ba3565ecdfa65d92902a29f2d7bb16e

SHA512
198017aebbc2c095cb9783a73aa83991db7bec25b8c9094ea915d52fe5f9f3241e31f2f177887e9f8331fe4e88778e4c935651e50197f3bbcaa8d23e745dca54

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095021\Microsoft.Support.Diagnostic.MiniPack.LtsBoot.dll
MD5
8dcf01cd0b2dac15e78394e60b296b57

SHA1
0699560bea68710a137fab2807c6007d28099151

SHA256
869d2b4998c31e5e07135b84334eb0c42518177ca6f20feb7fae6ba9c04ec5bf

SHA512
8221d06f090269378316cc123906fff51322403b68d7d62189319ab8550f8bf3f8ba28ad64627de2424ff7febf3ab757280e206c16d8681bce58d51eb877cead

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095021\ProcessLTSReport.ps1
MD5
eba14689c700d5ff7ec65a0ada255cd5

SHA1
348def56a79f15c85e14f3b6055935a4a7e6a62b

SHA256
40822cbb111ebb5d35d8629ffd4ecc86ad43391103b08315d434710167863037

SHA512
9bac89873521cf4cff5c23ba42ca16e85af376015e5cf8fd9ae81d71bc0d1f7e3b653a3da6c60b715057c35d6dcad09acd92672e48b3838dd015b68a05bd90cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
be45d38da7abb62c1f9e45af3f925ee2

SHA1
c1f870f3ebbfea432d842f1a720b1ba0f07a754d

SHA256
a532b2061681153ae741fa24d5b7b29d9ae7405886c5b3d8d8a4dcf8f3e8084e

SHA512
0272c246a9e8d48fc2226f11ff5ad8ae0114bb39b9850fe6315045510b151c03fcf497d3878dc4e4b21baa3836bdd8add1093d3038bc89379f5f094bc7ef703b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
be45d38da7abb62c1f9e45af3f925ee2

SHA1
c1f870f3ebbfea432d842f1a720b1ba0f07a754d

SHA256
a532b2061681153ae741fa24d5b7b29d9ae7405886c5b3d8d8a4dcf8f3e8084e

SHA512
0272c246a9e8d48fc2226f11ff5ad8ae0114bb39b9850fe6315045510b151c03fcf497d3878dc4e4b21baa3836bdd8add1093d3038bc89379f5f094bc7ef703b

Download Submit
memory/920-4-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/920-6-0x000000001B580000-0x000000001B581000-memory.dmp

Filesize
4KB

Download
memory/920-11-0x000000001AAA0000-0x000000001AAA1000-memory.dmp

Filesize
4KB

Download
memory/920-15-0x000000001B690000-0x000000001B691000-memory.dmp

Filesize
4KB

Download
memory/920-30-0x000000001B6D0000-0x000000001B6D1000-memory.dmp

Filesize
4KB

Download
memory/920-5-0x000000001C200000-0x000000001C201000-memory.dmp

Filesize
4KB

Download
memory/920-31-0x000000001B6E0000-0x000000001B6E1000-memory.dmp

Filesize
4KB

Download
memory/920-3-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/920-0-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/920-2-0x000000001ABD0000-0x000000001ABD1000-memory.dmp

Filesize
4KB

Download
memory/920-1-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1700-33-0x000000001C1E0000-0x000000001C1E4000-memory.dmp

Filesize
16KB

Download
memory/1700-32-0x000000001C1E0000-0x000000001C1E4000-memory.dmp

Filesize
16KB

Download
memory/1700-38-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1700-7-0x0000000000000000-mapping.dmp

Download
memory/1700-35-0x000000001C360000-0x000000001C361000-memory.dmp

Filesize
4KB

Download
memory/1700-9-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-36-0x000000001C3F0000-0x000000001C3F1000-memory.dmp

Filesize
4KB

Download
memory/1824-44-0x000000001ACC0000-0x000000001ACC1000-memory.dmp

Filesize
4KB

Download
memory/1824-45-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/1824-46-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/1824-43-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1824-49-0x000000001C1F0000-0x000000001C1F4000-memory.dmp

Filesize
16KB

Download
memory/1824-48-0x000000001C1F0000-0x000000001C1F4000-memory.dmp

Filesize
16KB

Download
memory/1824-50-0x000000001B570000-0x000000001B571000-memory.dmp

Filesize
4KB

Download
memory/1824-42-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1824-40-0x0000000000000000-mapping.dmp

Download