159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
11s
max time network
119s
platform
windows10_x64
resource
win10
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20052/ProcessLTSReport.ps1
Size

26KB
MD5

0b55c7c19a022631808799344f199029
SHA1

38d39e7316a0ae81891da768b3da21c40b4bfb0b
SHA256

c7a47c9386efbfe8ec75b0ceb91cbabe6d7754524e2236232c84b5450a57a769
SHA512

a9f41e53c4d9f1bdf3918d9175e12a3471d38fbbb2ba6117434ceeb90880a82a5a96fab9b7676a239b8632b251d9e502e27d616656d009a9b1328b842efc136f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
1800	powershell.exe
1800	powershell.exe
1800	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3324 powershell.exe
Token: SeDebugPrivilege 1800 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 3324 wrote to memory of 1800	3324	powershell.exe	powershell.exe
PID 3324 wrote to memory of 1800	3324	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
f290ff33102bc945b87b6871ce2f7cc4

SHA1
45f1664693c3d7c3b483897e69be3dac5618dd1a

SHA256
3f889f11dfa53455f75f8bad373308ba35e5016ede65b9785626322d131727a6

SHA512
f7f6e6ed9a03a5c31a904438736951698a335d508802cd9b0386e69df41671cdb9650d67d1d59aca30b3a4908d676dfb37bc7bff41f8796bef671152a5d6f57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
127c9ab31f6182427d6419904d3116b5

SHA1
0e095b71fda60a16e9ea227e4e308a42e88e5aaa

SHA256
5d418f97d588960dd88e10434e1258453c849bce626b9b803ca5efa390c4d3f3

SHA512
cd0066f552b1c7796d5c5072c1da35789e49d2d4d904cc4280f8ed605ca0c89e52066ebbc709a2290085337be25991310bffa18546e464c0151229922c831ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
memory/1800-5-0x0000000000000000-mapping.dmp

Download
memory/1800-7-0x00007FFF012D0000-0x00007FFF01CBC000-memory.dmp

Filesize
9.9MB

Download
memory/3324-0-0x00007FFF012D0000-0x00007FFF01CBC000-memory.dmp

Filesize
9.9MB

Download
memory/3324-1-0x000002EB04560000-0x000002EB04561000-memory.dmp

Filesize
4KB

Download
memory/3324-2-0x000002EB1EC20000-0x000002EB1EC21000-memory.dmp

Filesize
4KB

Download
memory/3324-3-0x000002EB1CA50000-0x000002EB1CA51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads