159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
12s
max time network
111s
platform
windows10_x64
resource
win10v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/ProcessLTSReport.ps1
Size

26KB
MD5

717c2dd58b182938d9a12f88d1598d98
SHA1

f75a9da0ce4930c2d3e2ee8f47894816a8495e31
SHA256

7769969cf24c21e80b88a12b02c0278f9e7009c64c5636ae31d9626a6be6f40c
SHA512

ba696667b5b5bdbff6da1d734e5a2236d3260dfe64d13719b1975f05732e7dc78332045f12faad6a9581fc2493aec85608080100841576865dd0bfbd70391e81

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
500	powershell.exe
500	powershell.exe
500	powershell.exe
500	powershell.exe
500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 500 powershell.exe
Token: SeDebugPrivilege 3500 powershell.exe

description	pid	process
Token: SeDebugPrivilege	500	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 500 wrote to memory of 3500	500	powershell.exe	powershell.exe
PID 500 wrote to memory of 3500	500	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
f290ff33102bc945b87b6871ce2f7cc4

SHA1
45f1664693c3d7c3b483897e69be3dac5618dd1a

SHA256
3f889f11dfa53455f75f8bad373308ba35e5016ede65b9785626322d131727a6

SHA512
f7f6e6ed9a03a5c31a904438736951698a335d508802cd9b0386e69df41671cdb9650d67d1d59aca30b3a4908d676dfb37bc7bff41f8796bef671152a5d6f57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
ca9e9a3b3b584630da278ed7d0b70545

SHA1
a2b0c6e93467a27cd5db5145b9135a37fa82d621

SHA256
906f4238a355e0bf7b26b7f5559b3ffc94fce8523ce88e5c5bf6bca13d318efc

SHA512
7cf75882a90dfcdfa46de98720b48204b7890ce7cbd9b792402aac84a787921b8f4e57fe0db4038b0aa6aed25330506fdb9731361f400a42bdc3b56c83a6aa0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
memory/500-0-0x00007FF9DDB70000-0x00007FF9DE55C000-memory.dmp

Filesize
9.9MB

Download
memory/500-1-0x0000022133500000-0x0000022133501000-memory.dmp

Filesize
4KB

Download
memory/500-2-0x000002214E370000-0x000002214E371000-memory.dmp

Filesize
4KB

Download
memory/500-3-0x0000022133570000-0x0000022133571000-memory.dmp

Filesize
4KB

Download
memory/3500-5-0x0000000000000000-mapping.dmp

Download
memory/3500-7-0x00007FF9DDB70000-0x00007FF9DE55C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads