159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
12s
max time network
113s
platform
windows10_x64
resource
win10v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20055/ProcessLTSReport.ps1
Size

26KB
MD5

d44cbffb251b87998898140f0ea7db8a
SHA1

be3e8a3b1dcb47d58033b0af08de407361849e81
SHA256

c506b3d5ec0c86cb0eb76bf5457b9e53a461927e89b3a7263fee8e5d4297b08a
SHA512

f286647eea51df6230c3f6e664124f30d58731b95d5c0c354c6a82799b9e6f2ab3fa9f2e087c39642406b0f40d2a9ff3bb781758c7cd881e998b87d6bd63d530

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
500	powershell.exe
500	powershell.exe
500	powershell.exe
500	powershell.exe
500	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 500 powershell.exe
Token: SeDebugPrivilege 1776 powershell.exe

description	pid	process
Token: SeDebugPrivilege	500	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 500 wrote to memory of 1776	500	powershell.exe	powershell.exe
PID 500 wrote to memory of 1776	500	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
f290ff33102bc945b87b6871ce2f7cc4

SHA1
45f1664693c3d7c3b483897e69be3dac5618dd1a

SHA256
3f889f11dfa53455f75f8bad373308ba35e5016ede65b9785626322d131727a6

SHA512
f7f6e6ed9a03a5c31a904438736951698a335d508802cd9b0386e69df41671cdb9650d67d1d59aca30b3a4908d676dfb37bc7bff41f8796bef671152a5d6f57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
f6a4df0bb3c34ba95a111485525fa634

SHA1
11ba5094c58ed805abfa6e81a4f649ac28738627

SHA256
dbdc57625e4bcec175a382d18a4de0c65c728e70d28c489a4f69b909a5b0c258

SHA512
8a7c398cb8d93daca1f516c0645b728808b2860571f6952c0e53ea3fd958edfd91c810beb37eb6c3f83436b7c9db4a752e7bca8291c1fa99c7276ae947331683

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
memory/500-0-0x00007FFC62E70000-0x00007FFC6385C000-memory.dmp

Filesize
9.9MB

Download
memory/500-1-0x000001DF4B0F0000-0x000001DF4B0F1000-memory.dmp

Filesize
4KB

Download
memory/500-2-0x000001DF656E0000-0x000001DF656E1000-memory.dmp

Filesize
4KB

Download
memory/500-3-0x000001DF65680000-0x000001DF65681000-memory.dmp

Filesize
4KB

Download
memory/1776-5-0x0000000000000000-mapping.dmp

Download
memory/1776-7-0x00007FFC62E70000-0x00007FFC6385C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads