159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
19s
max time network
11s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20054/ProcessLTSReport.ps1
Size

26KB
MD5

134618eb7032dceb1e9dbc94ccad44ef
SHA1

a8ed9ea3d350906690d41e2ad7dd51d16862a338
SHA256

7ff89d65bbadcffe3d4aea6295dc32249395ca28c4d71073bcf104cfc110e44e
SHA512

29eaff24b46fab9ff582a68ac8f3544f7c1ac10b6af9b6cff356ecefe30288b706bb06a132d9427a2ef3b6b4338b35acd76c9a65a31cd20c7d97c855e751d654

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

1608 powershell.exe
1608 powershell.exe
1608 powershell.exe
1564 powershell.exe
1564 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1608 powershell.exe
Token: SeDebugPrivilege 1564 powershell.exe

pid	process
1608	powershell.exe
1608	powershell.exe
1608	powershell.exe
1564	powershell.exe
1564	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1608 wrote to memory of 1564	1608	powershell.exe	powershell.exe
PID 1608 wrote to memory of 1564	1608	powershell.exe	powershell.exe
PID 1608 wrote to memory of 1564	1608	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
80d6d45368a2afd1cb54a6f0fbb3d303

SHA1
5a7c7a75757afc46fd29e7c6137b6c49134edfec

SHA256
51480d9afff20ad73b1b6178fb6d77ef9549546031a987f55923869242256a11

SHA512
b67c950267f215c6e284801031acba3c93b90d2efed5f64bcb75966f9f9f344cadd089aded63f3868c223d42176b7e7467115ab6a19fc09422a19db71ee03ff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
d15dc37ad327fb34f2cd3ff8215979ce

SHA1
4cae7cb4e50ea970c3638b18901438c6acfda0b5

SHA256
97a756088ce2a8a0982d53bf634fbcdaa6800e90c78554f8972f611002d421b6

SHA512
e0f9979462e94f61782271232c122682dbde4efd5d00ae97a5e1943b78db22cdb33ddccee3080a551834ce14aa5a1ae1d78e296b7f3b958e946b3caae4559f32

Download Submit
memory/1564-13-0x000000001ACE0000-0x000000001ACE1000-memory.dmp

Filesize
4KB

Download
memory/1564-14-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/1564-18-0x000000001B690000-0x000000001B691000-memory.dmp

Filesize
4KB

Download
memory/1564-15-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1564-12-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1564-9-0x0000000000000000-mapping.dmp

Download
memory/1564-11-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

Filesize
9.9MB

Download
memory/1608-3-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1608-7-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/1608-0-0x000007FEF6B60000-0x000007FEF754C000-memory.dmp

Filesize
9.9MB

Download
memory/1608-4-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/1608-6-0x000000001C650000-0x000000001C651000-memory.dmp

Filesize
4KB

Download
memory/1608-2-0x000000001AD60000-0x000000001AD61000-memory.dmp

Filesize
4KB

Download
memory/1608-1-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1608-5-0x000000001AC40000-0x000000001AC41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads