159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
19s
max time network
23s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20052/ProcessLTSReport.ps1
Size

26KB
MD5

0b55c7c19a022631808799344f199029
SHA1

38d39e7316a0ae81891da768b3da21c40b4bfb0b
SHA256

c7a47c9386efbfe8ec75b0ceb91cbabe6d7754524e2236232c84b5450a57a769
SHA512

a9f41e53c4d9f1bdf3918d9175e12a3471d38fbbb2ba6117434ceeb90880a82a5a96fab9b7676a239b8632b251d9e502e27d616656d009a9b1328b842efc136f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

1396 powershell.exe
1396 powershell.exe
1396 powershell.exe
1624 powershell.exe
1624 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1396 powershell.exe
Token: SeDebugPrivilege 1624 powershell.exe

pid	process
1396	powershell.exe
1396	powershell.exe
1396	powershell.exe
1624	powershell.exe
1624	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1396 wrote to memory of 1624	1396	powershell.exe	powershell.exe
PID 1396 wrote to memory of 1624	1396	powershell.exe	powershell.exe
PID 1396 wrote to memory of 1624	1396	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
3c547ce417ea1b3c2b97c60d10b34dff

SHA1
1caea14fcf4248de8878395b970eb68bb8ee4f18

SHA256
6ea0a28d6f5fd59f867e587f3e9cfbe575356e0d7408a7f4d767ebf7012664b8

SHA512
32d725f10aaadda514a06b7decdf7db3f768f6a47236ab93220249f3fcfff4ff8b0980c769cf402c5210ca7ea563af4edb81af5fb8b646a6a6e3f7a8b5c6fb51

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
8802e821e73cd202ef7651fd8cb99ca5

SHA1
30862477f504207c5318e24f3aaaffb6ab45e27d

SHA256
57b09d58324ad8e5bf0a3a1db166d4380375073675bfe07012deca1c5ac2706a

SHA512
81bc5492f5cd12d710983929ad3f869de15eff98d68ba545c93778069fea3faf311a410af239c32da34995d6da15bf92dba7cb887cb1ab9292ab945db350f402

Download Submit
memory/1396-1-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1396-2-0x000000001AA90000-0x000000001AA91000-memory.dmp

Filesize
4KB

Download
memory/1396-3-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/1396-4-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1396-5-0x000000001B780000-0x000000001B781000-memory.dmp

Filesize
4KB

Download
memory/1396-6-0x000000001C680000-0x000000001C681000-memory.dmp

Filesize
4KB

Download
memory/1396-7-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/1396-0-0x000007FEF66D0000-0x000007FEF70BC000-memory.dmp

Filesize
9.9MB

Download
memory/1624-9-0x0000000000000000-mapping.dmp

Download
memory/1624-13-0x000000001AB90000-0x000000001AB91000-memory.dmp

Filesize
4KB

Download
memory/1624-14-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1624-15-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1624-12-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/1624-11-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/1624-18-0x000000001B600000-0x000000001B601000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads