159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
9s
max time network
9s
platform
windows7_x64
resource
win7
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/ProcessLTSReport.ps1
Size

26KB
MD5

6e136acf04efbc9372a00e9420852168
SHA1

4787d1d97c781c6edafc2e9365d148548a2ffcd7
SHA256

96d0719cedda0e822af8d88387bb8773e27f42b811e03d77a9497d30c8809c43
SHA512

27b5ae1c4d214b5337a84a334190d8d2429246f6332b98d326dd7c99a89cfc7d24577ea1b5d23ff9b3cb85193c68ccc445a84a3d3e02b7818db58890f0d66c7b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

1544 powershell.exe
1544 powershell.exe
1544 powershell.exe
1996 powershell.exe
1996 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1544 powershell.exe
Token: SeDebugPrivilege 1996 powershell.exe

pid	process
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1996	powershell.exe
1996	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1544 wrote to memory of 1996	1544	powershell.exe	powershell.exe
PID 1544 wrote to memory of 1996	1544	powershell.exe	powershell.exe
PID 1544 wrote to memory of 1996	1544	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
8acac4be507e3d8a9a49130c25c2607b

SHA1
9bd1e8e7e7030b01b20d24d5abc07eb5ddcabf5c

SHA256
8db47e0c2d0d5a4284d373e49e59f7043b6d91b3b6587e5a867ba3e82fc34589

SHA512
1c328ce82cc253bff46a0ec5918f2581ffa09717b3dd38411fa72e3149dbc6b5e5ce9fce5000d71b49de32cd2861f1f8b51b17cbc9133451253c72cf781dcc75

Download Submit
C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
5dc372fcde679eb597c9d125007a939b

SHA1
5e24acbcf15479e79ac7a522d2f9209619804732

SHA256
85678bf268546f8d5255e651cdf8b03ee4274c98779a8d0002c68610ef72ce74

SHA512
c5263032a8277f430523ae9e7d937032c5bf90fd0784a6480304c9f5907106a8ea6a6a8cae25a98adfd045099e0e0381d2596571719772091d2b21e5cb50e000

Download Submit
memory/1544-1-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1544-2-0x000000001AB50000-0x000000001AB51000-memory.dmp

Filesize
4KB

Download
memory/1544-3-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/1544-4-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/1544-5-0x000000001B670000-0x000000001B671000-memory.dmp

Filesize
4KB

Download
memory/1544-6-0x000000001B740000-0x000000001B741000-memory.dmp

Filesize
4KB

Download
memory/1544-7-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/1544-0-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/1996-9-0x0000000000000000-mapping.dmp

Download
memory/1996-12-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/1996-14-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/1996-15-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/1996-13-0x000000001ADA0000-0x000000001ADA1000-memory.dmp

Filesize
4KB

Download
memory/1996-11-0x000007FEF5A50000-0x000007FEF643C000-memory.dmp

Filesize
9.9MB

Download
memory/1996-18-0x000000001B8E0000-0x000000001B8E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads