5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68

Analysis

max time kernel
44s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
19-04-2022 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68.exe
Size

3.4MB
MD5

96e48f0f832b8d9ab6e34a25edf9b35f
SHA1

226113af79947ef48088f2db35c98df4261ea15d
SHA256

5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68
SHA512

7c6f24c1c6f59e7e6331351c3526aceaf57c74d005e56e72294f3ddef154baddec9e6f060a92bc6ae0eb8876e9024d9d07e79d31cdc49800d790c5024a7b67aa

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1420 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1420 powershell.exe

pid	process
1420	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1420	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68.exe

description	pid	process	target process
PID 1924 wrote to memory of 1420	1924	5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68.exe	powershell.exe
PID 1924 wrote to memory of 1420	1924	5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68.exe	powershell.exe
PID 1924 wrote to memory of 1420	1924	5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68.exe	powershell.exe
PID 1924 wrote to memory of 1420	1924	5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68.exe
"C:\Users\Admin\AppData\Local\Temp\5af77a762d660414bc2691e7403f34b3356c156292e0a65162897c58b14c1e68.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
  -ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\get-points.ps1

Filesize
3.0MB

MD5
bcac3bbb18f093dbc8e5e76d2675695f

SHA1
96453f65b41e428937349e6f48fe67d6dfd6a580

SHA256
b25768626991b9a33e3ada79e3beb92fa5d83e1b50f2820e6fa2d6cf4827b21a

SHA512
78c55502c7d0484b458fadb78bc075b8eda01b794e2037283df11dc58105bd632c0e747e92fd7aac7b79c5ac0ddce9bb2c6e7ce158c743c9f080a52eda0498ab

Download Submit
memory/1420-64-0x0000000002452000-0x0000000002454000-memory.dmp

Filesize
8KB

Download
memory/1420-67-0x000000000245B000-0x000000000247A000-memory.dmp

Filesize
124KB

Download
memory/1420-56-0x0000000000000000-mapping.dmp

Download
memory/1420-57-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/1420-62-0x000000001B770000-0x000000001BA6F000-memory.dmp

Filesize
3.0MB

Download
memory/1420-65-0x0000000002454000-0x0000000002457000-memory.dmp

Filesize
12KB

Download
memory/1420-60-0x000007FEF1DC0000-0x000007FEF291D000-memory.dmp

Filesize
11.4MB

Download
memory/1420-63-0x0000000002450000-0x0000000002452000-memory.dmp

Filesize
8KB

Download
memory/1924-58-0x0000000003EC0000-0x00000000041FD000-memory.dmp

Filesize
3.2MB

Download
memory/1924-61-0x0000000000040000-0x0000000002268000-memory.dmp

Filesize
34.2MB

Download
memory/1924-59-0x0000000004200000-0x00000000046AC000-memory.dmp

Filesize
4.7MB

Download
memory/1924-54-0x0000000003EC0000-0x00000000041FD000-memory.dmp

Filesize
3.2MB

Download
memory/1924-55-0x0000000075541000-0x0000000075543000-memory.dmp

Filesize
8KB

Download