f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
19-04-2022 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe
Size

3.5MB
MD5

430153f225c19501842717a80283c9ed
SHA1

b53056dd325af27d8c295731dbbe102ace42def6
SHA256

f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab
SHA512

a9051ad3af63a3bed0c63ab7e6ea26a8b4fc944bbf4eca394f1ea07f645c0fd94551fe2b33d86ca62fc86f6ee2ee515ad95b51473511466a679858468cdba8d2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

904 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 904 powershell.exe

pid	process
904	powershell.exe

description	pid	process
Token: SeDebugPrivilege	904	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe

description	pid	process	target process
PID 1652 wrote to memory of 904	1652	f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe	powershell.exe
PID 1652 wrote to memory of 904	1652	f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe	powershell.exe
PID 1652 wrote to memory of 904	1652	f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe	powershell.exe
PID 1652 wrote to memory of 904	1652	f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe
"C:\Users\Admin\AppData\Local\Temp\f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
-ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\get-points.ps1
Filesize
3.0MB

MD5
bcac3bbb18f093dbc8e5e76d2675695f

SHA1
96453f65b41e428937349e6f48fe67d6dfd6a580

SHA256
b25768626991b9a33e3ada79e3beb92fa5d83e1b50f2820e6fa2d6cf4827b21a

SHA512
78c55502c7d0484b458fadb78bc075b8eda01b794e2037283df11dc58105bd632c0e747e92fd7aac7b79c5ac0ddce9bb2c6e7ce158c743c9f080a52eda0498ab

Download Submit
memory/904-64-0x0000000002854000-0x0000000002857000-memory.dmp

Filesize
12KB

Download
memory/904-67-0x000000000285B000-0x000000000287A000-memory.dmp

Filesize
124KB

Download
memory/904-56-0x0000000000000000-mapping.dmp

Download
memory/904-58-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Filesize
8KB

Download
memory/904-65-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/904-60-0x000007FEF2FC0000-0x000007FEF3B1D000-memory.dmp

Filesize
11.4MB

Download
memory/904-62-0x0000000002850000-0x0000000002852000-memory.dmp

Filesize
8KB

Download
memory/904-63-0x0000000002852000-0x0000000002854000-memory.dmp

Filesize
8KB

Download
memory/1652-57-0x0000000002170000-0x00000000024AD000-memory.dmp

Filesize
3.2MB

Download
memory/1652-61-0x0000000000040000-0x00000000004F8000-memory.dmp

Filesize
4.7MB

Download
memory/1652-59-0x00000000024B0000-0x000000000295C000-memory.dmp

Filesize
4.7MB

Download
memory/1652-54-0x0000000002170000-0x00000000024AD000-memory.dmp

Filesize
3.2MB

Download
memory/1652-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads