159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20052/Win8GlobalDetector.ps1
Size

9KB
MD5

bab12378ed4fbb86e28adeb533963070
SHA1

edcd33252267414b9c2e6ded6707a770821f1743
SHA256

86abe0a3a29c34c179db317753f1b0866bcb9f8844e0449968d444f814e78952
SHA512

e1895023ec6c04564823c1ae79a3c5a153a6bf51fd5a7705543f426c84b9adafe94727a8bd7e62b7fc443ff99aaea9716aca9c2207b7131c5f7ff8f5df353624

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 864 powershell.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1068 powershell.exe
864 powershell.exe
864 powershell.exe
864 powershell.exe
864 powershell.exe
1108 powershell.exe
1108 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1068 powershell.exe
Token: SeDebugPrivilege 864 powershell.exe
Token: SeDebugPrivilege 1108 powershell.exe

flow	pid	process
5	864	powershell.exe

pid	process
1068	powershell.exe
864	powershell.exe
864	powershell.exe
864	powershell.exe
864	powershell.exe
1108	powershell.exe
1108	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process	target process
PID 1068 wrote to memory of 864	1068	powershell.exe	powershell.exe
PID 1068 wrote to memory of 864	1068	powershell.exe	powershell.exe
PID 1068 wrote to memory of 864	1068	powershell.exe	powershell.exe
PID 864 wrote to memory of 1108	864	powershell.exe	powershell.exe
PID 864 wrote to memory of 1108	864	powershell.exe	powershell.exe
PID 864 wrote to memory of 1108	864	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\Win8GlobalDetector.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy unrestricted -command C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_073747\ProcessLTSReport.ps1
2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_073747\LTSCleanup.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
adea76cc55ca51606aa9d26b7720feb4

SHA1
b98db6c7233d434ff0100eb798005a7aa2905c00

SHA256
04bcb692fbf5ad3c067dc3f7f648026617bcb5ea1237143bebff4ca53e03b3cd

SHA512
1923d7ab49c1c840b4aed6c99ea3c4a92757f108058f7350866db21193f568857e85babbe7ffb7c7a0a429cfb36120db89bb4d060f37e4b09c120181c9840fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_073747\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_073747\Lts_amd64.dll
MD5
0bb6bdf5c6b40b753520c9b9cb96747f

SHA1
64cd0cf38065757a614ac093f1e3a715a970fea6

SHA256
70ea558e5e169505c5fdfd8a9d58dcecb47a73784a3075089304aa0805074b84

SHA512
b3cc8e4fe06f12f6308d1ef71811c9955a02c605f4f1326eb2144dd3ba75997103104e314ac0acc949cc31710fdae3f9dbe1c72b2a8ef87025bb31709746e677

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_073747\Lts_x86.dll
MD5
b1cd3050f7241e4a238f1c08766df4c8

SHA1
b2590f4ad227a852da9a84e9095e74dc545b3bd1

SHA256
146047bd5e4680263060291694fb1ac74ba3565ecdfa65d92902a29f2d7bb16e

SHA512
198017aebbc2c095cb9783a73aa83991db7bec25b8c9094ea915d52fe5f9f3241e31f2f177887e9f8331fe4e88778e4c935651e50197f3bbcaa8d23e745dca54

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_073747\Microsoft.Support.Diagnostic.MiniPack.LtsBoot.dll
MD5
8dcf01cd0b2dac15e78394e60b296b57

SHA1
0699560bea68710a137fab2807c6007d28099151

SHA256
869d2b4998c31e5e07135b84334eb0c42518177ca6f20feb7fae6ba9c04ec5bf

SHA512
8221d06f090269378316cc123906fff51322403b68d7d62189319ab8550f8bf3f8ba28ad64627de2424ff7febf3ab757280e206c16d8681bce58d51eb877cead

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_073747\ProcessLTSReport.ps1
MD5
0b55c7c19a022631808799344f199029

SHA1
38d39e7316a0ae81891da768b3da21c40b4bfb0b

SHA256
c7a47c9386efbfe8ec75b0ceb91cbabe6d7754524e2236232c84b5450a57a769

SHA512
a9f41e53c4d9f1bdf3918d9175e12a3471d38fbbb2ba6117434ceeb90880a82a5a96fab9b7676a239b8632b251d9e502e27d616656d009a9b1328b842efc136f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
ab825fb68f6277c99b2d89c3fbb71f8d

SHA1
b7f0af98cef5a0b6533b766733354bcc08a0aa1a

SHA256
32df079d9aa36bd7ac80f05e3557a086d70c50dd3072baccb22863f74fbff055

SHA512
898ff75abd1abfbb567b8163fb7415cf55ebf603e5dc773829fc7f4ebe712f15fe224782161c957cf994f2adc1f894e3dd7650b1b7597009c756e5666d7bbbae

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
ab825fb68f6277c99b2d89c3fbb71f8d

SHA1
b7f0af98cef5a0b6533b766733354bcc08a0aa1a

SHA256
32df079d9aa36bd7ac80f05e3557a086d70c50dd3072baccb22863f74fbff055

SHA512
898ff75abd1abfbb567b8163fb7415cf55ebf603e5dc773829fc7f4ebe712f15fe224782161c957cf994f2adc1f894e3dd7650b1b7597009c756e5666d7bbbae

Download Submit
memory/864-7-0x0000000000000000-mapping.dmp

Download
memory/864-36-0x000000001C930000-0x000000001C931000-memory.dmp

Filesize
4KB

Download
memory/864-35-0x000000001C5D0000-0x000000001C5D1000-memory.dmp

Filesize
4KB

Download
memory/864-18-0x000007FEF5910000-0x000007FEF62FC000-memory.dmp

Filesize
9.9MB

Download
memory/864-38-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/864-33-0x000000001C4D0000-0x000000001C4D4000-memory.dmp

Filesize
16KB

Download
memory/864-29-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/864-30-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/864-32-0x000000001C4D0000-0x000000001C4D4000-memory.dmp

Filesize
16KB

Download
memory/1068-9-0x000000001AC30000-0x000000001AC31000-memory.dmp

Filesize
4KB

Download
memory/1068-3-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/1068-25-0x000000001B970000-0x000000001B971000-memory.dmp

Filesize
4KB

Download
memory/1068-12-0x000000001C650000-0x000000001C651000-memory.dmp

Filesize
4KB

Download
memory/1068-0-0x000007FEF5910000-0x000007FEF62FC000-memory.dmp

Filesize
9.9MB

Download
memory/1068-6-0x000000001BA70000-0x000000001BA71000-memory.dmp

Filesize
4KB

Download
memory/1068-5-0x000000001B8A0000-0x000000001B8A1000-memory.dmp

Filesize
4KB

Download
memory/1068-1-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/1068-4-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/1068-26-0x000000001B980000-0x000000001B981000-memory.dmp

Filesize
4KB

Download
memory/1068-2-0x000000001ACF0000-0x000000001ACF1000-memory.dmp

Filesize
4KB

Download
memory/1108-42-0x000007FEF5910000-0x000007FEF62FC000-memory.dmp

Filesize
9.9MB

Download
memory/1108-45-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1108-46-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/1108-44-0x000000001AC20000-0x000000001AC21000-memory.dmp

Filesize
4KB

Download
memory/1108-48-0x000000001C2E0000-0x000000001C2E4000-memory.dmp

Filesize
16KB

Download
memory/1108-49-0x000000001C2E0000-0x000000001C2E4000-memory.dmp

Filesize
16KB

Download
memory/1108-50-0x000000001B690000-0x000000001B691000-memory.dmp

Filesize
4KB

Download
memory/1108-43-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1108-40-0x0000000000000000-mapping.dmp

Download