159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
15s
max time network
11s
platform
windows7_x64
resource
win7
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoreOption/Win8RC.TS.ps1
Size

10KB
MD5

30d84818cab9908b29de582f3c585b12
SHA1

23c4f44426ac43c9e34231840bc42ff2e0fa50c1
SHA256

c761ef8a0d96d37ea626a5e88d4683733ce872f0924d9f21e0073782d781946b
SHA512

999e1adbc633b86b3fe727b13e8c074b1f3a8534e0ee832b7f47e6ba1c2cc5da5672879afe98dc1dd8ed1b8a524a3d50f666eda5a19dbcf3e342acc26c36089a

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1868 powershell.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1424 powershell.exe
1868 powershell.exe
1868 powershell.exe
1868 powershell.exe
1868 powershell.exe
980 powershell.exe
980 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1424 powershell.exe
Token: SeDebugPrivilege 1868 powershell.exe
Token: SeDebugPrivilege 980 powershell.exe

flow	pid	process
4	1868	powershell.exe

pid	process
1424	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
980	powershell.exe
980	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process	target process
PID 1424 wrote to memory of 1868	1424	powershell.exe	powershell.exe
PID 1424 wrote to memory of 1868	1424	powershell.exe	powershell.exe
PID 1424 wrote to memory of 1868	1424	powershell.exe	powershell.exe
PID 1868 wrote to memory of 980	1868	powershell.exe	powershell.exe
PID 1868 wrote to memory of 980	1868	powershell.exe	powershell.exe
PID 1868 wrote to memory of 980	1868	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MoreOption\Win8RC.TS.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy unrestricted -command C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_081133\ProcessLTSReport.ps1
2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_081133\LTSCleanup.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
b5d0120962c83fa444b3a1dfa7c30bbb

SHA1
9db9f5f03130f9ef8a28f1391485fd2f01fe45c8

SHA256
d0313438e7ad0cf776fe6bb64addf93249a35e1c607589dc53aeaab29fdb3e7f

SHA512
9a2c7707f14f39125d0dfcf9de1362d13109fe4d52715a9a2c29ccaffcbc2058cad9a590fe7c6d5cc36a675fad38a1a97af2797600c091a6776942eb7329d58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_081133\LTSCleanup.ps1
MD5
fcfddb3ebe9574ad1dfa1839aec67232

SHA1
9b9b649bc0bc18f1228d4b46ea5137c02566b5e8

SHA256
71998ac10c3c273d512cd156904fba532a253058060b1bf6152985510c75817a

SHA512
0f5d4b637b54152e937f4772f77ceba2c6fab702fe042aad93850d4dd8b7963e99207dc7ec058312319f7e5a16dd16ed054ed98bbc6b93b06b0b11402c639922

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_081133\Lts_amd64.dll
MD5
0bb6bdf5c6b40b753520c9b9cb96747f

SHA1
64cd0cf38065757a614ac093f1e3a715a970fea6

SHA256
70ea558e5e169505c5fdfd8a9d58dcecb47a73784a3075089304aa0805074b84

SHA512
b3cc8e4fe06f12f6308d1ef71811c9955a02c605f4f1326eb2144dd3ba75997103104e314ac0acc949cc31710fdae3f9dbe1c72b2a8ef87025bb31709746e677

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_081133\Lts_x86.dll
MD5
b1cd3050f7241e4a238f1c08766df4c8

SHA1
b2590f4ad227a852da9a84e9095e74dc545b3bd1

SHA256
146047bd5e4680263060291694fb1ac74ba3565ecdfa65d92902a29f2d7bb16e

SHA512
198017aebbc2c095cb9783a73aa83991db7bec25b8c9094ea915d52fe5f9f3241e31f2f177887e9f8331fe4e88778e4c935651e50197f3bbcaa8d23e745dca54

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_081133\Microsoft.Support.Diagnostic.MiniPack.LtsBoot.dll
MD5
8dcf01cd0b2dac15e78394e60b296b57

SHA1
0699560bea68710a137fab2807c6007d28099151

SHA256
869d2b4998c31e5e07135b84334eb0c42518177ca6f20feb7fae6ba9c04ec5bf

SHA512
8221d06f090269378316cc123906fff51322403b68d7d62189319ab8550f8bf3f8ba28ad64627de2424ff7febf3ab757280e206c16d8681bce58d51eb877cead

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinipackTEMP_10222020_081133\ProcessLTSReport.ps1
MD5
6e136acf04efbc9372a00e9420852168

SHA1
4787d1d97c781c6edafc2e9365d148548a2ffcd7

SHA256
96d0719cedda0e822af8d88387bb8773e27f42b811e03d77a9497d30c8809c43

SHA512
27b5ae1c4d214b5337a84a334190d8d2429246f6332b98d326dd7c99a89cfc7d24577ea1b5d23ff9b3cb85193c68ccc445a84a3d3e02b7818db58890f0d66c7b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
daa49766316600271ae44592b8f541d3

SHA1
0dc3fb9f2729a01dbe4bc2b860229359a4e1ac79

SHA256
62df4168f9fc2de27383c1d0a4ed554a7056534d909cc2240c6d146d4640e6c4

SHA512
b56a3f3b121faa31f0f0f2ba1e4bfba8fd047a0c40f67e41729c560a806d5c011f119e93fcb68bf9283b0e9725049d35fba8d601a0ba74a7552ada645e4153aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
daa49766316600271ae44592b8f541d3

SHA1
0dc3fb9f2729a01dbe4bc2b860229359a4e1ac79

SHA256
62df4168f9fc2de27383c1d0a4ed554a7056534d909cc2240c6d146d4640e6c4

SHA512
b56a3f3b121faa31f0f0f2ba1e4bfba8fd047a0c40f67e41729c560a806d5c011f119e93fcb68bf9283b0e9725049d35fba8d601a0ba74a7552ada645e4153aa

Download Submit
memory/980-44-0x000000001AD80000-0x000000001AD81000-memory.dmp

Filesize
4KB

Download
memory/980-40-0x0000000000000000-mapping.dmp

Download
memory/980-50-0x000000001B810000-0x000000001B811000-memory.dmp

Filesize
4KB

Download
memory/980-49-0x000000001C280000-0x000000001C284000-memory.dmp

Filesize
16KB

Download
memory/980-48-0x000000001C280000-0x000000001C284000-memory.dmp

Filesize
16KB

Download
memory/980-46-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/980-45-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/980-43-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/980-42-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp

Filesize
9.9MB

Download
memory/1424-0-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

Filesize
9.9MB

Download
memory/1424-28-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/1424-1-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/1424-2-0x000000001AD50000-0x000000001AD51000-memory.dmp

Filesize
4KB

Download
memory/1424-5-0x000000001C760000-0x000000001C761000-memory.dmp

Filesize
4KB

Download
memory/1424-6-0x000000001B7C0000-0x000000001B7C1000-memory.dmp

Filesize
4KB

Download
memory/1424-11-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1424-4-0x0000000002060000-0x0000000002061000-memory.dmp

Filesize
4KB

Download
memory/1424-15-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/1424-29-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/1424-3-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/1868-38-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/1868-30-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/1868-9-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

Filesize
9.9MB

Download
memory/1868-7-0x0000000000000000-mapping.dmp

Download
memory/1868-32-0x000000001C630000-0x000000001C634000-memory.dmp

Filesize
16KB

Download
memory/1868-33-0x000000001C630000-0x000000001C634000-memory.dmp

Filesize
16KB

Download
memory/1868-36-0x000000001C790000-0x000000001C791000-memory.dmp

Filesize
4KB

Download
memory/1868-35-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download