229bc74efaec13853ed9774d20581e3e56221d26f17c6ff6221722d9dfa80ba5 | Triage

Analysis

max time kernel
167s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 07:07

Sharing

Report Analysis Logs

General

Target

virtual_freer_v1.58/callback.ps1
Size

8KB
MD5

8236f4cb9ad4204ef295b2f9129d1e94
SHA1

6393374e5f281f71f290af4a5d034737ed5ed4a5
SHA256

e6802e0fea8e1ab71f534ee9b3fb86dc20596a287ea0411a3e0b5eb672764faa
SHA512

089b23220bb79aef2622f72c3ce27fcad896865e0ca7c2959e8f94a8f0e808efcda35f28f4d6bab61b6c4b3a0fb635b3c7d13d431eb0b968ad551a40c091bbc0

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4824 powershell.exe
4824 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4824 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\callback.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4824-130-0x0000024276BB0000-0x0000024276BD2000-memory.dmp

Filesize
136KB

Download
memory/4824-131-0x00007FFA048D0000-0x00007FFA05391000-memory.dmp

Filesize
10.8MB

Download