229bc74efaec13853ed9774d20581e3e56221d26f17c6ff6221722d9dfa80ba5 | Triage

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 07:07

Sharing

Report Analysis Logs

General

Target

virtual_freer_v1.58/back/setting.ps1
Size

9KB
MD5

4de52162c06221bfeba0924b613494ab
SHA1

702fb237e3d3c95c7bbabb079bf154f08aaaf756
SHA256

8bc9a3adcb4ef7a8162934a5a448d6b08452f68740ece55deee5245941a8bdaa
SHA512

cb1dbecf94117c6dc4dc24e6a8e2de089a3ab381451126455e98e5a5af944544875129ceeaa03711095468595e44c31c5122f5063b2f98636677371ba586b7fa

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1656 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1656 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\back\setting.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/1656-55-0x000007FEF3BD0000-0x000007FEF472D000-memory.dmp

Filesize
11.4MB

Download
memory/1656-56-0x00000000027C4000-0x00000000027C7000-memory.dmp

Filesize
12KB

Download
memory/1656-57-0x00000000027CB000-0x00000000027EA000-memory.dmp

Filesize
124KB

Download