Analysis

  • max time kernel
    136s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 07:07

General

  • Target

    virtual_freer_v1.58/back/setting.ps1

  • Size

    9KB

  • MD5

    4de52162c06221bfeba0924b613494ab

  • SHA1

    702fb237e3d3c95c7bbabb079bf154f08aaaf756

  • SHA256

    8bc9a3adcb4ef7a8162934a5a448d6b08452f68740ece55deee5245941a8bdaa

  • SHA512

    cb1dbecf94117c6dc4dc24e6a8e2de089a3ab381451126455e98e5a5af944544875129ceeaa03711095468595e44c31c5122f5063b2f98636677371ba586b7fa

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\back\setting.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2880-130-0x0000027925090000-0x00000279250B2000-memory.dmp
    Filesize

    136KB

  • memory/2880-131-0x00007FFC628A0000-0x00007FFC63361000-memory.dmp
    Filesize

    10.8MB