Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
05-12-2021 00:17
Static task
static1
Behavioral task
behavioral1
Sample
OTSLG.ps1
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
OTSLG.ps1
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
dump_stage1.ps1
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
dump_stage1.ps1
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
dump_stage2.ps1
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
dump_stage2.ps1
Resource
win10-en-20211104
General
-
Target
OTSLG.ps1
-
Size
915KB
-
MD5
001bfe6f72fe64660ba498107c658bdc
-
SHA1
0946baf23e867f2564302b60f777db72a1244a30
-
SHA256
c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da
-
SHA512
32836eff8285a5a301be0b4410d34a73d99d4c04b38b0b67b937c1bc5ae6ab2d033a97089b6588c245371dfd8e95c420c8bbd3862a632a828122861e0ec839d3
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1852 powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1456 powershell.exe 1456 powershell.exe 1456 powershell.exe 1852 powershell.exe 1852 powershell.exe 1852 powershell.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 1456 powershell.exe Token: SeDebugPrivilege 1852 powershell.exe Token: SeBackupPrivilege 1852 powershell.exe Token: SeDebugPrivilege 1852 powershell.exe Token: 36 1852 powershell.exe Token: SeImpersonatePrivilege 1852 powershell.exe Token: SeIncBasePriorityPrivilege 1852 powershell.exe Token: SeIncreaseQuotaPrivilege 1852 powershell.exe Token: 33 1852 powershell.exe Token: SeManageVolumePrivilege 1852 powershell.exe Token: SeProfSingleProcessPrivilege 1852 powershell.exe Token: SeRestorePrivilege 1852 powershell.exe Token: SeSecurityPrivilege 1852 powershell.exe Token: SeSystemProfilePrivilege 1852 powershell.exe Token: SeTakeOwnershipPrivilege 1852 powershell.exe Token: SeShutdownPrivilege 1852 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1456 wrote to memory of 1852 1456 powershell.exe 29 PID 1456 wrote to memory of 1852 1456 powershell.exe 29 PID 1456 wrote to memory of 1852 1456 powershell.exe 29 PID 1456 wrote to memory of 1852 1456 powershell.exe 29
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\OTSLG.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -NonI C:\Users\Admin\AppData\Local\Temp\OTSLG.ps12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852
-