c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da

Analysis

Target

OTSLG.ps1
Size

915KB
MD5

001bfe6f72fe64660ba498107c658bdc
SHA1

0946baf23e867f2564302b60f777db72a1244a30
SHA256

c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da
SHA512

32836eff8285a5a301be0b4410d34a73d99d4c04b38b0b67b937c1bc5ae6ab2d033a97089b6588c245371dfd8e95c420c8bbd3862a632a828122861e0ec839d3

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1408	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeBackupPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: 36	1408	powershell.exe
Token: SeImpersonatePrivilege	1408	powershell.exe
Token: SeIncBasePriorityPrivilege	1408	powershell.exe
Token: SeIncreaseQuotaPrivilege	1408	powershell.exe
Token: 33	1408	powershell.exe
Token: SeManageVolumePrivilege	1408	powershell.exe
Token: SeProfSingleProcessPrivilege	1408	powershell.exe
Token: SeRestorePrivilege	1408	powershell.exe
Token: SeSecurityPrivilege	1408	powershell.exe
Token: SeSystemProfilePrivilege	1408	powershell.exe
Token: SeTakeOwnershipPrivilege	1408	powershell.exe
Token: SeShutdownPrivilege	1408	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1408	1664	powershell.exe	29
PID 1664 wrote to memory of 1408	1664	powershell.exe	29
PID 1664 wrote to memory of 1408	1664	powershell.exe	29
PID 1664 wrote to memory of 1408	1664	powershell.exe	29

memory/1408-67-0x0000000007F26000-0x0000000007F27000-memory.dmp

Filesize
4KB

Download
memory/1408-65-0x0000000007F15000-0x0000000007F26000-memory.dmp

Filesize
68KB

Download
memory/1408-66-0x0000000007F10000-0x0000000007F11000-memory.dmp

Filesize
4KB

Download
memory/1408-64-0x00000000024A0000-0x00000000030EA000-memory.dmp

Filesize
12.3MB

Download
memory/1408-63-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1664-58-0x0000000002982000-0x0000000002984000-memory.dmp

Filesize
8KB

Download
memory/1664-61-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/1664-60-0x000000001B850000-0x000000001BB4F000-memory.dmp

Filesize
3.0MB

Download
memory/1664-59-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1664-55-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp

Filesize
8KB

Download
memory/1664-57-0x0000000002980000-0x0000000002982000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x000007FEF2920000-0x000007FEF347D000-memory.dmp

Filesize
11.4MB

Download