159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
12s
max time network
110s
platform
windows10_x64
resource
win10v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/ProcessLTSReport.ps1
Size

26KB
MD5

6e136acf04efbc9372a00e9420852168
SHA1

4787d1d97c781c6edafc2e9365d148548a2ffcd7
SHA256

96d0719cedda0e822af8d88387bb8773e27f42b811e03d77a9497d30c8809c43
SHA512

27b5ae1c4d214b5337a84a334190d8d2429246f6332b98d326dd7c99a89cfc7d24577ea1b5d23ff9b3cb85193c68ccc445a84a3d3e02b7818db58890f0d66c7b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
412	powershell.exe
412	powershell.exe
412	powershell.exe
412	powershell.exe
412	powershell.exe
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 412 powershell.exe
Token: SeDebugPrivilege 3300 powershell.exe

description	pid	process
Token: SeDebugPrivilege	412	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 412 wrote to memory of 3300	412	powershell.exe	powershell.exe
PID 412 wrote to memory of 3300	412	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\ProcessLTSReport.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
f290ff33102bc945b87b6871ce2f7cc4

SHA1
45f1664693c3d7c3b483897e69be3dac5618dd1a

SHA256
3f889f11dfa53455f75f8bad373308ba35e5016ede65b9785626322d131727a6

SHA512
f7f6e6ed9a03a5c31a904438736951698a335d508802cd9b0386e69df41671cdb9650d67d1d59aca30b3a4908d676dfb37bc7bff41f8796bef671152a5d6f57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
5253bceb6d80117863123d8e691562fd

SHA1
9353934e651f9cf007a0e9f972c8c9c01810d91b

SHA256
f334dbf48c083c037898ab0d3bf8956d073f4ce26058ecc2d526a07927964cdf

SHA512
a49b8c882a079c981855d27e6629d7bafde0607746efb4ba96e6d7454504d7def42fc9c5a8cc4e7ce957343385f17038f59358a5368cee699a3cb308df5bc8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MoreOption\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
memory/412-0-0x00007FFBA0B40000-0x00007FFBA152C000-memory.dmp

Filesize
9.9MB

Download
memory/412-1-0x0000022470710000-0x0000022470711000-memory.dmp

Filesize
4KB

Download
memory/412-2-0x0000022470C90000-0x0000022470C91000-memory.dmp

Filesize
4KB

Download
memory/412-3-0x0000022470770000-0x0000022470771000-memory.dmp

Filesize
4KB

Download
memory/3300-5-0x0000000000000000-mapping.dmp

Download
memory/3300-7-0x00007FFBA0B40000-0x00007FFBA152C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads