159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
12s
max time network
18s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20055/ProcessLTSReport.ps1
Size

26KB
MD5

d44cbffb251b87998898140f0ea7db8a
SHA1

be3e8a3b1dcb47d58033b0af08de407361849e81
SHA256

c506b3d5ec0c86cb0eb76bf5457b9e53a461927e89b3a7263fee8e5d4297b08a
SHA512

f286647eea51df6230c3f6e664124f30d58731b95d5c0c354c6a82799b9e6f2ab3fa9f2e087c39642406b0f40d2a9ff3bb781758c7cd881e998b87d6bd63d530

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

1508 powershell.exe
1508 powershell.exe
1508 powershell.exe
1628 powershell.exe
1628 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1508 powershell.exe
Token: SeDebugPrivilege 1628 powershell.exe

pid	process
1508	powershell.exe
1508	powershell.exe
1508	powershell.exe
1628	powershell.exe
1628	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1508 wrote to memory of 1628	1508	powershell.exe	powershell.exe
PID 1508 wrote to memory of 1628	1508	powershell.exe	powershell.exe
PID 1508 wrote to memory of 1628	1508	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
d46003e4b4368fe7cf934bcc4faeefd4

SHA1
b2ef0aea92d19f473091ec28aaf170abcad38fb8

SHA256
83980ceb1e752631bf93331d14808bac3c937ebcc74f037f9d02a4c66e65b37c

SHA512
415b921dfed851661300cdce64f1c055a0464c684c42e8db24e50e51b3e842ed8afa7545645c764755757c7fdb70b5f4963f1c273e9e37837554ac997acc0e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
2211141af28ed5eeffd352185cc0ebbf

SHA1
4367747970123b870506dadd3bf14a188969489f

SHA256
f731c121cedf3c068653fd81257f207c0cbdd09ded4e36d5fa18470982c4ccde

SHA512
d8b739dfeafacf8fda07690cbceb1dd84549876d6eb8d1e0e960c25f638e440384dedc8c807f490d69668a2f5d1c290fcbaa0ae606ee4aa7eaa77fa04ab221e3

Download Submit
memory/1508-1-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/1508-2-0x000000001ACA0000-0x000000001ACA1000-memory.dmp

Filesize
4KB

Download
memory/1508-3-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1508-4-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1508-5-0x000000001AB80000-0x000000001AB81000-memory.dmp

Filesize
4KB

Download
memory/1508-6-0x000000001C6F0000-0x000000001C6F1000-memory.dmp

Filesize
4KB

Download
memory/1508-7-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/1508-0-0x000007FEF6A00000-0x000007FEF73EC000-memory.dmp

Filesize
9.9MB

Download
memory/1628-9-0x0000000000000000-mapping.dmp

Download
memory/1628-12-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/1628-14-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/1628-15-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/1628-13-0x000000001ABD0000-0x000000001ABD1000-memory.dmp

Filesize
4KB

Download
memory/1628-11-0x000007FEF6A00000-0x000007FEF73EC000-memory.dmp

Filesize
9.9MB

Download
memory/1628-18-0x000000001AAB0000-0x000000001AAB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads