159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
12s
max time network
75s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/Win8GlobalDetector.ps1
Size

9KB
MD5

3335fc6d8615340316800c61e6341328
SHA1

13e242b7a8d435ec3b47153e753c420f40132804
SHA256

7dde1325901d8d2a0d72864a1c833c5110a47a5ad7ab755a962e930ac1944259
SHA512

07d23f4330ce3bfa124f61b50d329f8407c59bcf19dac5702f95d7b84f1aeed4257a9edeec35f5f672f85740d457949705eac02a1dd3557d6363f48587f2e125

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1008 powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

1320 powershell.exe
1008 powershell.exe
1008 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1320 powershell.exe
Token: SeDebugPrivilege 1008 powershell.exe

flow	pid	process
4	1008	powershell.exe

pid	process
1320	powershell.exe
1008	powershell.exe
1008	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1320 wrote to memory of 1008	1320	powershell.exe	powershell.exe
PID 1320 wrote to memory of 1008	1320	powershell.exe	powershell.exe
PID 1320 wrote to memory of 1008	1320	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\Win8GlobalDetector.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy unrestricted -command C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_101113\ProcessLTSReport.ps1
2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_101113\ProcessLTSReport.ps1
MD5
6e136acf04efbc9372a00e9420852168

SHA1
4787d1d97c781c6edafc2e9365d148548a2ffcd7

SHA256
96d0719cedda0e822af8d88387bb8773e27f42b811e03d77a9497d30c8809c43

SHA512
27b5ae1c4d214b5337a84a334190d8d2429246f6332b98d326dd7c99a89cfc7d24577ea1b5d23ff9b3cb85193c68ccc445a84a3d3e02b7818db58890f0d66c7b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
e13d0859facf12728dfc4703ce8fba04

SHA1
68abe6f2596e8969a012c283a3a460a71de69a15

SHA256
d2014fe5a7797add42b5f371b1669f5223fe4792d0ad68e9228f18dc4ef43ce6

SHA512
90dfb38006be1ab662ae8f5933feb82eb9d06c2d14d5887c0a0df9f6451f5fbacc29d505964449c93a877412623b506fd6f0747e3493e7801ac8d7da1d2c5f25

Download Submit
memory/1008-7-0x0000000000000000-mapping.dmp

Download
memory/1008-27-0x000000001C360000-0x000000001C364000-memory.dmp

Filesize
16KB

Download
memory/1008-26-0x000000001C360000-0x000000001C364000-memory.dmp

Filesize
16KB

Download
memory/1008-9-0x000007FEF5C10000-0x000007FEF65FC000-memory.dmp

Filesize
9.9MB

Download
memory/1320-3-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1320-6-0x000000001BA40000-0x000000001BA41000-memory.dmp

Filesize
4KB

Download
memory/1320-5-0x000000001B960000-0x000000001B961000-memory.dmp

Filesize
4KB

Download
memory/1320-4-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/1320-12-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/1320-16-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/1320-0-0x000007FEF5C10000-0x000007FEF65FC000-memory.dmp

Filesize
9.9MB

Download
memory/1320-2-0x000000001AC40000-0x000000001AC41000-memory.dmp

Filesize
4KB

Download
memory/1320-1-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download