159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
10s
max time network
9s
platform
windows7_x64
resource
win7
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/ProcessLTSReport.ps1
Size

26KB
MD5

717c2dd58b182938d9a12f88d1598d98
SHA1

f75a9da0ce4930c2d3e2ee8f47894816a8495e31
SHA256

7769969cf24c21e80b88a12b02c0278f9e7009c64c5636ae31d9626a6be6f40c
SHA512

ba696667b5b5bdbff6da1d734e5a2236d3260dfe64d13719b1975f05732e7dc78332045f12faad6a9581fc2493aec85608080100841576865dd0bfbd70391e81

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

1544 powershell.exe
1544 powershell.exe
1544 powershell.exe
1976 powershell.exe
1976 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1544 powershell.exe
Token: SeDebugPrivilege 1976 powershell.exe

pid	process
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1976	powershell.exe
1976	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1544 wrote to memory of 1976	1544	powershell.exe	powershell.exe
PID 1544 wrote to memory of 1976	1544	powershell.exe	powershell.exe
PID 1544 wrote to memory of 1976	1544	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
5b3de12d4c9ade9a4ab1f2cdbc2ab863

SHA1
efb39aa9c7f9d530cc1f640ec8648750fe8a584d

SHA256
6b15345af7a3c88a95b0f5e5ed4f359cf7122385d03d85bfb555d8b2bbcc06c9

SHA512
d8ca506c05a800477bf177bf6cd6d798472e8b581280e5d3dabf918001e9e68c90dc8ce1d9791eeb5fc7eb44cdd1bfda45f28b73604c509f0e5c852f61e0822e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
adbde68b618cf5806433b18651434077

SHA1
b092a07e239ade5d0c52ce5019c3a82dc133b461

SHA256
a1d7f9e744a8b8e749bca9be6852cdab258fa422146187ebe20c054028de268f

SHA512
f26a036ebaba98bf7cd0ef3a0d8355b32343015608f2314b2e66c1220b65ff1247377f29bf3966fca5f5cfa5e4d9d011978a95f93c91e655e7726eb021401b4c

Download Submit
memory/1544-1-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1544-2-0x000000001AA50000-0x000000001AA51000-memory.dmp

Filesize
4KB

Download
memory/1544-3-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/1544-4-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1544-5-0x000000001B5E0000-0x000000001B5E1000-memory.dmp

Filesize
4KB

Download
memory/1544-6-0x000000001C250000-0x000000001C251000-memory.dmp

Filesize
4KB

Download
memory/1544-7-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1544-0-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-9-0x0000000000000000-mapping.dmp

Download
memory/1976-13-0x000000001ABA0000-0x000000001ABA1000-memory.dmp

Filesize
4KB

Download
memory/1976-14-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/1976-15-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/1976-12-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/1976-11-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/1976-18-0x000000001B450000-0x000000001B451000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads