229bc74efaec13853ed9774d20581e3e56221d26f17c6ff6221722d9dfa80ba5 | Triage

Analysis

max time kernel
36s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 07:07

Sharing

Report Analysis Logs

General

Target

virtual_freer_v1.58/callback.ps1
Size

8KB
MD5

8236f4cb9ad4204ef295b2f9129d1e94
SHA1

6393374e5f281f71f290af4a5d034737ed5ed4a5
SHA256

e6802e0fea8e1ab71f534ee9b3fb86dc20596a287ea0411a3e0b5eb672764faa
SHA512

089b23220bb79aef2622f72c3ce27fcad896865e0ca7c2959e8f94a8f0e808efcda35f28f4d6bab61b6c4b3a0fb635b3c7d13d431eb0b968ad551a40c091bbc0

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1928 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1928 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\callback.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Filesize
8KB

Download
memory/1928-56-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1928-55-0x000007FEF3460000-0x000007FEF3FBD000-memory.dmp

Filesize
11.4MB

Download
memory/1928-57-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download