159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
9s
max time network
117s
platform
windows10_x64
resource
win10
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20054/ProcessLTSReport.ps1
Size

26KB
MD5

134618eb7032dceb1e9dbc94ccad44ef
SHA1

a8ed9ea3d350906690d41e2ad7dd51d16862a338
SHA256

7ff89d65bbadcffe3d4aea6295dc32249395ca28c4d71073bcf104cfc110e44e
SHA512

29eaff24b46fab9ff582a68ac8f3544f7c1ac10b6af9b6cff356ecefe30288b706bb06a132d9427a2ef3b6b4338b35acd76c9a65a31cd20c7d97c855e751d654

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe
1464	powershell.exe
1464	powershell.exe
1464	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3828 powershell.exe
Token: SeDebugPrivilege 1464 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 3828 wrote to memory of 1464	3828	powershell.exe	powershell.exe
PID 3828 wrote to memory of 1464	3828	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
f290ff33102bc945b87b6871ce2f7cc4

SHA1
45f1664693c3d7c3b483897e69be3dac5618dd1a

SHA256
3f889f11dfa53455f75f8bad373308ba35e5016ede65b9785626322d131727a6

SHA512
f7f6e6ed9a03a5c31a904438736951698a335d508802cd9b0386e69df41671cdb9650d67d1d59aca30b3a4908d676dfb37bc7bff41f8796bef671152a5d6f57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
42bc717ca8b68da44e8d2d0b9261058b

SHA1
8fb43dd2d861a90d22383fc854cc98ebd1e25ff7

SHA256
d03eba8ed7d5b9b5db3f6dffa13e776fa3035479d9c3b38d1eff92563324860f

SHA512
ff3cad23401c068fcf74d66c399dcf7c3d6cc5dcff41ab654dae71823d28f6283e5636536db49906ea0cf7eae5ecfe2ea91e9a39c7d119d6896cb86690dd98e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
memory/1464-5-0x0000000000000000-mapping.dmp

Download
memory/1464-7-0x00007FF9D1110000-0x00007FF9D1AFC000-memory.dmp

Filesize
9.9MB

Download
memory/3828-0-0x00007FF9D1110000-0x00007FF9D1AFC000-memory.dmp

Filesize
9.9MB

Download
memory/3828-1-0x00000242A7100000-0x00000242A7101000-memory.dmp

Filesize
4KB

Download
memory/3828-2-0x00000242A74B0000-0x00000242A74B1000-memory.dmp

Filesize
4KB

Download
memory/3828-3-0x00000242A7450000-0x00000242A7451000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads