67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98

Analysis

Target

67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98.exe
Size

3.4MB
MD5

512608823063f8b9568f67eb89337856
SHA1

57d0fb5026bbc365789b3999a8c35c7a6f79bbff
SHA256

67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98
SHA512

ecc7e4783a01f50fa6d7b7415d53d0c75f12c7c979d876f52739a9fbc9b784fb7ae4852a9098956e2c82d7f019c4815e7d8f0d2afcd728e708ae42de557f11fb

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1960	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1960	1908	67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98.exe	28
PID 1908 wrote to memory of 1960	1908	67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98.exe	28
PID 1908 wrote to memory of 1960	1908	67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98.exe	28
PID 1908 wrote to memory of 1960	1908	67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98.exe	28

C:\Users\Admin\AppData\Local\Temp\67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98.exe
"C:\Users\Admin\AppData\Local\Temp\67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
  -ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960

C:\Users\Admin\AppData\Local\Temp\get-points.ps1

Filesize
3.0MB

MD5
bcac3bbb18f093dbc8e5e76d2675695f

SHA1
96453f65b41e428937349e6f48fe67d6dfd6a580

SHA256
b25768626991b9a33e3ada79e3beb92fa5d83e1b50f2820e6fa2d6cf4827b21a

SHA512
78c55502c7d0484b458fadb78bc075b8eda01b794e2037283df11dc58105bd632c0e747e92fd7aac7b79c5ac0ddce9bb2c6e7ce158c743c9f080a52eda0498ab

Download Submit
memory/1908-54-0x0000000004BD0000-0x0000000004F0D000-memory.dmp

Filesize
3.2MB

Download
memory/1908-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1908-57-0x0000000004BD0000-0x0000000004F0D000-memory.dmp

Filesize
3.2MB

Download
memory/1908-64-0x0000000000040000-0x0000000002F40000-memory.dmp

Filesize
47.0MB

Download
memory/1908-59-0x0000000004F10000-0x00000000053BC000-memory.dmp

Filesize
4.7MB

Download
memory/1960-61-0x00000000024D0000-0x00000000024D2000-memory.dmp

Filesize
8KB

Download
memory/1960-62-0x00000000024D2000-0x00000000024D4000-memory.dmp

Filesize
8KB

Download
memory/1960-58-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download
memory/1960-63-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/1960-60-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

Filesize
11.4MB

Download
memory/1960-65-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/1960-67-0x00000000024DB000-0x00000000024FA000-memory.dmp

Filesize
124KB

Download