159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
23s
max time network
23s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20054/Win8RC.TS.ps1
Size

10KB
MD5

588019a7c3d91ae98f58de92bedb7531
SHA1

4734856e175e89d6ce083cdf2ec1264eb4054d23
SHA256

3325c88ec8dc898bb3ba2ddc10132fb3bdf630ac5320213b804a7ead2c7cb5c2
SHA512

161027cfcdc3851406d1af06506e874579f4530fe21a11f12529bc86bc60973e194711a670852f06854261c53385d06c1842e1845375f1ba0f110b625495976a

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 688 powershell.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1568 powershell.exe
688 powershell.exe
688 powershell.exe
688 powershell.exe
688 powershell.exe
948 powershell.exe
948 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1568 powershell.exe
Token: SeDebugPrivilege 688 powershell.exe
Token: SeDebugPrivilege 948 powershell.exe

flow	pid	process
5	688	powershell.exe

pid	process
1568	powershell.exe
688	powershell.exe
688	powershell.exe
688	powershell.exe
688	powershell.exe
948	powershell.exe
948	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	948	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process	target process
PID 1568 wrote to memory of 688	1568	powershell.exe	powershell.exe
PID 1568 wrote to memory of 688	1568	powershell.exe	powershell.exe
PID 1568 wrote to memory of 688	1568	powershell.exe	powershell.exe
PID 688 wrote to memory of 948	688	powershell.exe	powershell.exe
PID 688 wrote to memory of 948	688	powershell.exe	powershell.exe
PID 688 wrote to memory of 948	688	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\Win8RC.TS.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy unrestricted -command C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095551\ProcessLTSReport.ps1
2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095551\LTSCleanup.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
197acfc0dc35cf2e317361e91fdcf868

SHA1
9f660c16fc24c860f7e29e207186b251e23589d1

SHA256
52fbe65176d54502710f055cd92d0efcfdf25b5941983e0786dc574aa39aa2e0

SHA512
fea892327e94870a12a9d29782bf93c9918263c4d7460633d08b470c7ba2f451d340a0832af8b1f1ed29abeab62528e614d47319ac1379e7fb01ca6ee0502f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095551\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095551\Lts_amd64.dll
MD5
0bb6bdf5c6b40b753520c9b9cb96747f

SHA1
64cd0cf38065757a614ac093f1e3a715a970fea6

SHA256
70ea558e5e169505c5fdfd8a9d58dcecb47a73784a3075089304aa0805074b84

SHA512
b3cc8e4fe06f12f6308d1ef71811c9955a02c605f4f1326eb2144dd3ba75997103104e314ac0acc949cc31710fdae3f9dbe1c72b2a8ef87025bb31709746e677

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095551\Lts_x86.dll
MD5
b1cd3050f7241e4a238f1c08766df4c8

SHA1
b2590f4ad227a852da9a84e9095e74dc545b3bd1

SHA256
146047bd5e4680263060291694fb1ac74ba3565ecdfa65d92902a29f2d7bb16e

SHA512
198017aebbc2c095cb9783a73aa83991db7bec25b8c9094ea915d52fe5f9f3241e31f2f177887e9f8331fe4e88778e4c935651e50197f3bbcaa8d23e745dca54

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095551\Microsoft.Support.Diagnostic.MiniPack.LtsBoot.dll
MD5
8dcf01cd0b2dac15e78394e60b296b57

SHA1
0699560bea68710a137fab2807c6007d28099151

SHA256
869d2b4998c31e5e07135b84334eb0c42518177ca6f20feb7fae6ba9c04ec5bf

SHA512
8221d06f090269378316cc123906fff51322403b68d7d62189319ab8550f8bf3f8ba28ad64627de2424ff7febf3ab757280e206c16d8681bce58d51eb877cead

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095551\ProcessLTSReport.ps1
MD5
134618eb7032dceb1e9dbc94ccad44ef

SHA1
a8ed9ea3d350906690d41e2ad7dd51d16862a338

SHA256
7ff89d65bbadcffe3d4aea6295dc32249395ca28c4d71073bcf104cfc110e44e

SHA512
29eaff24b46fab9ff582a68ac8f3544f7c1ac10b6af9b6cff356ecefe30288b706bb06a132d9427a2ef3b6b4338b35acd76c9a65a31cd20c7d97c855e751d654

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
41c0cb19cc2b6d17acf98438f61caa3e

SHA1
0be177fa94d0b6ded9e14f7bf796a8ef906d406a

SHA256
03ae815c409bac2fdd1d2e7ef3508258f8020c58b8b61c7115017ff8b25321ad

SHA512
bdee3338f65a9bacb47596e1cc5ad25507a323348079ae8437c3872bb914e92ec21d305720c4e75721bfd7193c00414acac90ed7f3b900ab416fc0180eec6c96

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
41c0cb19cc2b6d17acf98438f61caa3e

SHA1
0be177fa94d0b6ded9e14f7bf796a8ef906d406a

SHA256
03ae815c409bac2fdd1d2e7ef3508258f8020c58b8b61c7115017ff8b25321ad

SHA512
bdee3338f65a9bacb47596e1cc5ad25507a323348079ae8437c3872bb914e92ec21d305720c4e75721bfd7193c00414acac90ed7f3b900ab416fc0180eec6c96

Download Submit
memory/688-35-0x000000001B680000-0x000000001B681000-memory.dmp

Filesize
4KB

Download
memory/688-36-0x000000001B870000-0x000000001B871000-memory.dmp

Filesize
4KB

Download
memory/688-33-0x000000001C2E0000-0x000000001C2E4000-memory.dmp

Filesize
16KB

Download
memory/688-24-0x0000000000000000-mapping.dmp

Download
memory/688-32-0x000000001C2E0000-0x000000001C2E4000-memory.dmp

Filesize
16KB

Download
memory/688-26-0x000007FEF6460000-0x000007FEF6E4C000-memory.dmp

Filesize
9.9MB

Download
memory/688-29-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/688-30-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/688-38-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/948-43-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/948-46-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/948-50-0x000000001C260000-0x000000001C261000-memory.dmp

Filesize
4KB

Download
memory/948-49-0x000000001C370000-0x000000001C374000-memory.dmp

Filesize
16KB

Download
memory/948-48-0x000000001C370000-0x000000001C374000-memory.dmp

Filesize
16KB

Download
memory/948-45-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/948-44-0x000000001AE60000-0x000000001AE61000-memory.dmp

Filesize
4KB

Download
memory/948-40-0x0000000000000000-mapping.dmp

Download
memory/948-42-0x000007FEF6460000-0x000007FEF6E4C000-memory.dmp

Filesize
9.9MB

Download
memory/1568-4-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/1568-0-0x000007FEF6460000-0x000007FEF6E4C000-memory.dmp

Filesize
9.9MB

Download
memory/1568-5-0x000000001C4A0000-0x000000001C4A1000-memory.dmp

Filesize
4KB

Download
memory/1568-6-0x000000001B810000-0x000000001B811000-memory.dmp

Filesize
4KB

Download
memory/1568-23-0x000000001C440000-0x000000001C441000-memory.dmp

Filesize
4KB

Download
memory/1568-3-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1568-7-0x000000001B4E0000-0x000000001B4E1000-memory.dmp

Filesize
4KB

Download
memory/1568-10-0x000000001B750000-0x000000001B751000-memory.dmp

Filesize
4KB

Download
memory/1568-22-0x000000001C430000-0x000000001C431000-memory.dmp

Filesize
4KB

Download
memory/1568-2-0x000000001AB70000-0x000000001AB71000-memory.dmp

Filesize
4KB

Download
memory/1568-1-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download