159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
23s
max time network
23s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/Win8GlobalDetector.ps1
Size

9KB
MD5

7191a56aca92a1161b973e44fdaea3fe
SHA1

a3f29b675e2eb2431c52ee995d90463631df4e98
SHA256

583a6ce850c4cfcfc677e2d36dfec2589e0cbb7b48ba90c43fcaddfdef7303c9
SHA512

6eab40cf6aaf8301ddc024224796a4abf54bf9eedab11ad3e8a15655269c52aff1db10b1f4df0df329a069a7df33fdbaec29811148212df4e001dc9c683f9e1c

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

2 1980 powershell.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1508 powershell.exe
1980 powershell.exe
1980 powershell.exe
1980 powershell.exe
1980 powershell.exe
1008 powershell.exe
1008 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1508 powershell.exe
Token: SeDebugPrivilege 1980 powershell.exe
Token: SeDebugPrivilege 1008 powershell.exe

flow	pid	process
2	1980	powershell.exe

pid	process
1508	powershell.exe
1980	powershell.exe
1980	powershell.exe
1980	powershell.exe
1980	powershell.exe
1008	powershell.exe
1008	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process	target process
PID 1508 wrote to memory of 1980	1508	powershell.exe	powershell.exe
PID 1508 wrote to memory of 1980	1508	powershell.exe	powershell.exe
PID 1508 wrote to memory of 1980	1508	powershell.exe	powershell.exe
PID 1980 wrote to memory of 1008	1980	powershell.exe	powershell.exe
PID 1980 wrote to memory of 1008	1980	powershell.exe	powershell.exe
PID 1980 wrote to memory of 1008	1980	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\Win8GlobalDetector.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy unrestricted -command C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095353\ProcessLTSReport.ps1
2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095353\LTSCleanup.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
f04565f14d3119b02e6ebc920eb324cf

SHA1
0e5cd9ce3ad4706f42e8e03a602f11408fbfcd95

SHA256
61bcfdb0717c97cb9f13d76e3ff7be9c860c7dae2878f1d3823203d84aae62b4

SHA512
2139ca1c1fb180e3b37a33da3e4000dd44cf9cd707aaaa872bbc4b185ca3da2100c1e6b22ee5c556d87894a6d7fa897dad7135437bcb9f4e5f6f226cd31c85b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095353\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095353\Lts_amd64.dll
MD5
0bb6bdf5c6b40b753520c9b9cb96747f

SHA1
64cd0cf38065757a614ac093f1e3a715a970fea6

SHA256
70ea558e5e169505c5fdfd8a9d58dcecb47a73784a3075089304aa0805074b84

SHA512
b3cc8e4fe06f12f6308d1ef71811c9955a02c605f4f1326eb2144dd3ba75997103104e314ac0acc949cc31710fdae3f9dbe1c72b2a8ef87025bb31709746e677

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095353\Lts_x86.dll
MD5
b1cd3050f7241e4a238f1c08766df4c8

SHA1
b2590f4ad227a852da9a84e9095e74dc545b3bd1

SHA256
146047bd5e4680263060291694fb1ac74ba3565ecdfa65d92902a29f2d7bb16e

SHA512
198017aebbc2c095cb9783a73aa83991db7bec25b8c9094ea915d52fe5f9f3241e31f2f177887e9f8331fe4e88778e4c935651e50197f3bbcaa8d23e745dca54

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095353\Microsoft.Support.Diagnostic.MiniPack.LtsBoot.dll
MD5
8dcf01cd0b2dac15e78394e60b296b57

SHA1
0699560bea68710a137fab2807c6007d28099151

SHA256
869d2b4998c31e5e07135b84334eb0c42518177ca6f20feb7fae6ba9c04ec5bf

SHA512
8221d06f090269378316cc123906fff51322403b68d7d62189319ab8550f8bf3f8ba28ad64627de2424ff7febf3ab757280e206c16d8681bce58d51eb877cead

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_095353\ProcessLTSReport.ps1
MD5
717c2dd58b182938d9a12f88d1598d98

SHA1
f75a9da0ce4930c2d3e2ee8f47894816a8495e31

SHA256
7769969cf24c21e80b88a12b02c0278f9e7009c64c5636ae31d9626a6be6f40c

SHA512
ba696667b5b5bdbff6da1d734e5a2236d3260dfe64d13719b1975f05732e7dc78332045f12faad6a9581fc2493aec85608080100841576865dd0bfbd70391e81

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
662f30fa1900e843b8881e57e6d95af8

SHA1
b4011bb6a33b1084f831b2df6855f6266f524cd7

SHA256
d8112f37a85af9f69ca7f2111b925ee81445cfe31f44461823c83e1f9f6f3336

SHA512
ea09103b1e42dd595964f10f873a9791466f1d399152434c4e3157ec15fae9e95049e8495ac29bcd94593cbf583375ea17ee5d1a92337b797476636d0ccda117

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
662f30fa1900e843b8881e57e6d95af8

SHA1
b4011bb6a33b1084f831b2df6855f6266f524cd7

SHA256
d8112f37a85af9f69ca7f2111b925ee81445cfe31f44461823c83e1f9f6f3336

SHA512
ea09103b1e42dd595964f10f873a9791466f1d399152434c4e3157ec15fae9e95049e8495ac29bcd94593cbf583375ea17ee5d1a92337b797476636d0ccda117

Download Submit
memory/1008-42-0x000007FEF6B20000-0x000007FEF750C000-memory.dmp

Filesize
9.9MB

Download
memory/1008-40-0x0000000000000000-mapping.dmp

Download
memory/1008-50-0x000000001C180000-0x000000001C181000-memory.dmp

Filesize
4KB

Download
memory/1008-49-0x000000001C2E0000-0x000000001C2E4000-memory.dmp

Filesize
16KB

Download
memory/1008-48-0x000000001C2E0000-0x000000001C2E4000-memory.dmp

Filesize
16KB

Download
memory/1008-46-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/1008-45-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/1008-44-0x000000001ABA0000-0x000000001ABA1000-memory.dmp

Filesize
4KB

Download
memory/1008-43-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1508-32-0x000000001B600000-0x000000001B601000-memory.dmp

Filesize
4KB

Download
memory/1508-3-0x000000001A910000-0x000000001A911000-memory.dmp

Filesize
4KB

Download
memory/1508-1-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1508-5-0x000000001B3E0000-0x000000001B3E1000-memory.dmp

Filesize
4KB

Download
memory/1508-2-0x000000001AA70000-0x000000001AA71000-memory.dmp

Filesize
4KB

Download
memory/1508-6-0x000000001C4F0000-0x000000001C4F1000-memory.dmp

Filesize
4KB

Download
memory/1508-4-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/1508-0-0x000007FEF6B20000-0x000007FEF750C000-memory.dmp

Filesize
9.9MB

Download
memory/1508-33-0x000000001B610000-0x000000001B611000-memory.dmp

Filesize
4KB

Download
memory/1508-13-0x000000001B6A0000-0x000000001B6A1000-memory.dmp

Filesize
4KB

Download
memory/1508-17-0x000000001B940000-0x000000001B941000-memory.dmp

Filesize
4KB

Download
memory/1980-9-0x000007FEF6B20000-0x000007FEF750C000-memory.dmp

Filesize
9.9MB

Download
memory/1980-30-0x000000001C290000-0x000000001C294000-memory.dmp

Filesize
16KB

Download
memory/1980-7-0x0000000000000000-mapping.dmp

Download
memory/1980-31-0x000000001C290000-0x000000001C294000-memory.dmp

Filesize
16KB

Download
memory/1980-35-0x000000001B600000-0x000000001B601000-memory.dmp

Filesize
4KB

Download
memory/1980-38-0x000000001A8F0000-0x000000001A8F1000-memory.dmp

Filesize
4KB

Download
memory/1980-36-0x000000001C410000-0x000000001C411000-memory.dmp

Filesize
4KB

Download