ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
18-04-2022 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05.exe
Size

3.4MB
MD5

71ee798de51093af096001f2d5dd5155
SHA1

44876fea883580c63b054354d200dc5ade33d60d
SHA256

ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05
SHA512

0e2c4020973dec93f63a8818cb10b74851ee8c8469a2375805b318bbeec83a80d4f383c3682ce9989d661ac01a38e9c42dc5ed22b775d121323bd9823d174aab

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
952	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	952	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05.exe

description	pid	Process	procid_target
PID 384 wrote to memory of 952	384	ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05.exe	28
PID 384 wrote to memory of 952	384	ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05.exe	28
PID 384 wrote to memory of 952	384	ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05.exe	28
PID 384 wrote to memory of 952	384	ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05.exe	28

C:\Users\Admin\AppData\Local\Temp\ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05.exe
"C:\Users\Admin\AppData\Local\Temp\ecd2d822106b3028f55f0adb383b22b4f308e0079cfcfcafb26227c4afe4ae05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
  -ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\get-points.ps1

Filesize
3.0MB

MD5
bcac3bbb18f093dbc8e5e76d2675695f

SHA1
96453f65b41e428937349e6f48fe67d6dfd6a580

SHA256
b25768626991b9a33e3ada79e3beb92fa5d83e1b50f2820e6fa2d6cf4827b21a

SHA512
78c55502c7d0484b458fadb78bc075b8eda01b794e2037283df11dc58105bd632c0e747e92fd7aac7b79c5ac0ddce9bb2c6e7ce158c743c9f080a52eda0498ab

Download Submit
memory/384-61-0x0000000000040000-0x0000000002F2A000-memory.dmp

Filesize
46.9MB

Download
memory/384-58-0x0000000004AD0000-0x0000000004E0D000-memory.dmp

Filesize
3.2MB

Download
memory/384-59-0x0000000004E10000-0x00000000052BC000-memory.dmp

Filesize
4.7MB

Download
memory/384-54-0x0000000004AD0000-0x0000000004E0D000-memory.dmp

Filesize
3.2MB

Download
memory/384-55-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/952-56-0x0000000000000000-mapping.dmp

Download
memory/952-57-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Filesize
8KB

Download
memory/952-60-0x000007FEF3820000-0x000007FEF437D000-memory.dmp

Filesize
11.4MB

Download
memory/952-62-0x0000000002220000-0x0000000002222000-memory.dmp

Filesize
8KB

Download
memory/952-63-0x0000000002222000-0x0000000002224000-memory.dmp

Filesize
8KB

Download
memory/952-64-0x0000000002224000-0x0000000002227000-memory.dmp

Filesize
12KB

Download
memory/952-65-0x000000001B860000-0x000000001BB5F000-memory.dmp

Filesize
3.0MB

Download
memory/952-67-0x000000000222B000-0x000000000224A000-memory.dmp

Filesize
124KB

Download