159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
25s
max time network
25s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftFixit20055/Win8RC.TS.ps1
Size

10KB
MD5

1098997bc6badc9c4c644e8a7969fc60
SHA1

dfea011f863d11c20452e55ea9df47bafb0fad66
SHA256

6e1dffe4e360de5cdfed7fe5a93fc22ed2e82e2673ebb2a8e6db2cf486914735
SHA512

4511cc71a506423398107d2b7d2d61a971b2a1c4dd4d7894dfa0d81ba66929658c0d742078f51c748750a5228273a21a35da13fefa750f7226381dc17456f9de

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 1632 powershell.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

752 powershell.exe
1632 powershell.exe
1632 powershell.exe
1632 powershell.exe
1632 powershell.exe
552 powershell.exe
552 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 752 powershell.exe
Token: SeDebugPrivilege 1632 powershell.exe
Token: SeDebugPrivilege 552 powershell.exe

flow	pid	process
3	1632	powershell.exe

pid	process
752	powershell.exe
1632	powershell.exe
1632	powershell.exe
1632	powershell.exe
1632	powershell.exe
552	powershell.exe
552	powershell.exe

description	pid	process
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process	target process
PID 752 wrote to memory of 1632	752	powershell.exe	powershell.exe
PID 752 wrote to memory of 1632	752	powershell.exe	powershell.exe
PID 752 wrote to memory of 1632	752	powershell.exe	powershell.exe
PID 1632 wrote to memory of 552	1632	powershell.exe	powershell.exe
PID 1632 wrote to memory of 552	1632	powershell.exe	powershell.exe
PID 1632 wrote to memory of 552	1632	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\Win8RC.TS.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy unrestricted -command C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_100624\ProcessLTSReport.ps1
2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_100624\LTSCleanup.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
6633b827c98fe4fa087ae24a43156418

SHA1
7f717feea68f1d711de51b76c6e3687700eb9ad4

SHA256
beebcfb89f45df4b15634aefd8b31fc9a3b69f2af72d5cfa31612a1bfbae629b

SHA512
b0c4824178a3bf7f393d5609f98c683b3b0f18ba7f2843a497d07241bbbd32d9715b9491d695379a5eccd827fab18703a8774e2b818072cc2b2a791a7e873143

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_100624\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_100624\Lts_amd64.dll
MD5
0bb6bdf5c6b40b753520c9b9cb96747f

SHA1
64cd0cf38065757a614ac093f1e3a715a970fea6

SHA256
70ea558e5e169505c5fdfd8a9d58dcecb47a73784a3075089304aa0805074b84

SHA512
b3cc8e4fe06f12f6308d1ef71811c9955a02c605f4f1326eb2144dd3ba75997103104e314ac0acc949cc31710fdae3f9dbe1c72b2a8ef87025bb31709746e677

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_100624\Lts_x86.dll
MD5
b1cd3050f7241e4a238f1c08766df4c8

SHA1
b2590f4ad227a852da9a84e9095e74dc545b3bd1

SHA256
146047bd5e4680263060291694fb1ac74ba3565ecdfa65d92902a29f2d7bb16e

SHA512
198017aebbc2c095cb9783a73aa83991db7bec25b8c9094ea915d52fe5f9f3241e31f2f177887e9f8331fe4e88778e4c935651e50197f3bbcaa8d23e745dca54

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_100624\Microsoft.Support.Diagnostic.MiniPack.LtsBoot.dll
MD5
8dcf01cd0b2dac15e78394e60b296b57

SHA1
0699560bea68710a137fab2807c6007d28099151

SHA256
869d2b4998c31e5e07135b84334eb0c42518177ca6f20feb7fae6ba9c04ec5bf

SHA512
8221d06f090269378316cc123906fff51322403b68d7d62189319ab8550f8bf3f8ba28ad64627de2424ff7febf3ab757280e206c16d8681bce58d51eb877cead

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_100624\ProcessLTSReport.ps1
MD5
d44cbffb251b87998898140f0ea7db8a

SHA1
be3e8a3b1dcb47d58033b0af08de407361849e81

SHA256
c506b3d5ec0c86cb0eb76bf5457b9e53a461927e89b3a7263fee8e5d4297b08a

SHA512
f286647eea51df6230c3f6e664124f30d58731b95d5c0c354c6a82799b9e6f2ab3fa9f2e087c39642406b0f40d2a9ff3bb781758c7cd881e998b87d6bd63d530

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
9e39a548ab40ac5acaa21ec37d3a17ea

SHA1
30a93604cee216753f26e5d927231aff10411ee4

SHA256
6173be0a23e89ddbb6d5a82569a2fa1ba23a4051be4117fa2c0a1e5d6254102d

SHA512
6c65e935d9537af26b086cc14c02a03baf5a62f95df0a026a51e2f61e91ab025e2e4aef1ac26b6b24df87bb4ad449625da1ef5c674231bdf0f5d3ee4dabc035e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
9e39a548ab40ac5acaa21ec37d3a17ea

SHA1
30a93604cee216753f26e5d927231aff10411ee4

SHA256
6173be0a23e89ddbb6d5a82569a2fa1ba23a4051be4117fa2c0a1e5d6254102d

SHA512
6c65e935d9537af26b086cc14c02a03baf5a62f95df0a026a51e2f61e91ab025e2e4aef1ac26b6b24df87bb4ad449625da1ef5c674231bdf0f5d3ee4dabc035e

Download Submit
memory/552-49-0x000000001C450000-0x000000001C454000-memory.dmp

Filesize
16KB

Download
memory/552-44-0x000000001AD00000-0x000000001AD01000-memory.dmp

Filesize
4KB

Download
memory/552-43-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/552-42-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Filesize
9.9MB

Download
memory/552-45-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/552-46-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/552-40-0x0000000000000000-mapping.dmp

Download
memory/552-48-0x000000001C450000-0x000000001C454000-memory.dmp

Filesize
16KB

Download
memory/552-50-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/752-22-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/752-0-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/752-1-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/752-2-0x000000001ABE0000-0x000000001ABE1000-memory.dmp

Filesize
4KB

Download
memory/752-3-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/752-4-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/752-5-0x000000001B910000-0x000000001B911000-memory.dmp

Filesize
4KB

Download
memory/752-6-0x000000001B7B0000-0x000000001B7B1000-memory.dmp

Filesize
4KB

Download
memory/752-7-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/752-10-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/752-23-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/1632-30-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/1632-24-0x0000000000000000-mapping.dmp

Download
memory/1632-26-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/1632-29-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/1632-38-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1632-33-0x000000001C3C0000-0x000000001C3C4000-memory.dmp

Filesize
16KB

Download
memory/1632-36-0x000000001C920000-0x000000001C921000-memory.dmp

Filesize
4KB

Download
memory/1632-35-0x000000001C790000-0x000000001C791000-memory.dmp

Filesize
4KB

Download
memory/1632-32-0x000000001C3C0000-0x000000001C3C4000-memory.dmp

Filesize
16KB

Download