229bc74efaec13853ed9774d20581e3e56221d26f17c6ff6221722d9dfa80ba5 | Triage

Analysis

max time kernel
158s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 07:07

Sharing

Report Analysis Logs

General

Target

virtual_freer_v1.58/back/cards.ps1
Size

22KB
MD5

dcc8c1c2a8101c0a2fdbfba419abd8b3
SHA1

48b432e1f26446ad2a1b06606bcd9b2b8f871337
SHA256

81a0b4177d24b49b74709d6035713f9398fd6230ba00855f7200734ea18be413
SHA512

abeef69d9f1d55786f053b985fc5d29e41ee73c81c7b3016e503ae655b3c30628b43ba32e7a17d57808226e0b1d63380ceb62c271c73c6b0354803eb2ecec1fe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2668 powershell.exe
2668 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2668 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\back\cards.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-130-0x00000190D6B50000-0x00000190D6B72000-memory.dmp

Filesize
136KB

Download
memory/2668-131-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

Filesize
10.8MB

Download