6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
18-04-2022 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92.exe
Size

3.4MB
MD5

5e1a581185a9e63ea8e8228b4737958b
SHA1

ffceda102fc3fe2663f848993be435bce1a17fd3
SHA256

6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92
SHA512

01e509d9a2af443e8c0320e3d3e656bd52d4244fe8d451cedbc2abd0bdef496c9a9e3e52639199b3a88425abe40dc011255876523f4f5ee18e2c59edee75df58

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1160 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1160 powershell.exe

pid	process
1160	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1160	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92.exe

description	pid	process	target process
PID 1676 wrote to memory of 1160	1676	6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92.exe	powershell.exe
PID 1676 wrote to memory of 1160	1676	6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92.exe	powershell.exe
PID 1676 wrote to memory of 1160	1676	6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92.exe	powershell.exe
PID 1676 wrote to memory of 1160	1676	6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92.exe
"C:\Users\Admin\AppData\Local\Temp\6c1c0f44893f2e5bf2290d05b9c031e65a5db7741d96110c5822ec2625bc0e92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
  -ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\get-points.ps1

Filesize
3.0MB

MD5
bcac3bbb18f093dbc8e5e76d2675695f

SHA1
96453f65b41e428937349e6f48fe67d6dfd6a580

SHA256
b25768626991b9a33e3ada79e3beb92fa5d83e1b50f2820e6fa2d6cf4827b21a

SHA512
78c55502c7d0484b458fadb78bc075b8eda01b794e2037283df11dc58105bd632c0e747e92fd7aac7b79c5ac0ddce9bb2c6e7ce158c743c9f080a52eda0498ab

Download Submit
memory/1160-64-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/1160-58-0x0000000000000000-mapping.dmp

Download
memory/1160-60-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Filesize
8KB

Download
memory/1160-62-0x00000000029A0000-0x00000000029A2000-memory.dmp

Filesize
8KB

Download
memory/1160-63-0x00000000029A2000-0x00000000029A4000-memory.dmp

Filesize
8KB

Download
memory/1160-61-0x000007FEF2FC0000-0x000007FEF3B1D000-memory.dmp

Filesize
11.4MB

Download
memory/1160-65-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/1160-67-0x00000000029AB000-0x00000000029CA000-memory.dmp

Filesize
124KB

Download
memory/1676-56-0x0000000003FD0000-0x000000000430D000-memory.dmp

Filesize
3.2MB

Download
memory/1676-57-0x0000000004310000-0x00000000047BC000-memory.dmp

Filesize
4.7MB

Download
memory/1676-59-0x0000000000040000-0x0000000002269000-memory.dmp

Filesize
34.2MB

Download
memory/1676-54-0x0000000003FD0000-0x000000000430D000-memory.dmp

Filesize
3.2MB

Download
memory/1676-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download