Overview

overview

10

Static

static

10

virtual_fr...ds.ps1

windows7_x64

1

virtual_fr...ds.ps1

windows10-2004_x64

1

virtual_fr...es.ps1

windows7_x64

1

virtual_fr...es.ps1

windows10-2004_x64

1

virtual_fr...ts.ps1

windows7_x64

1

virtual_fr...ts.ps1

windows10-2004_x64

1

virtual_fr...ns.ps1

windows7_x64

1

virtual_fr...ns.ps1

windows10-2004_x64

1

virtual_fr...cts.js

windows7_x64

1

virtual_fr...cts.js

windows10-2004_x64

1

virtual_fr...ng.ps1

windows7_x64

1

virtual_fr...ng.ps1

windows10-2004_x64

1

virtual_fr...der.js

windows7_x64

1

virtual_fr...der.js

windows10-2004_x64

1

virtual_fr...x.html

windows7_x64

1

virtual_fr...x.html

windows10-2004_x64

1

virtual_fr...ck.ps1

windows7_x64

1

virtual_fr...ck.ps1

windows10-2004_x64

1

virtual_fr...de.pdf

windows7_x64

1

virtual_fr...de.pdf

windows10-2004_x64

1

virtual_fr...nks.js

windows7_x64

1

virtual_fr...nks.js

windows10-2004_x64

1

virtual_fr...x.html

windows7_x64

1

virtual_fr...x.html

windows10-2004_x64

1

virtual_fr...ler.js

windows7_x64

1

virtual_fr...ler.js

windows10-2004_x64

1

virtual_fr...tp.ps1

windows7_x64

1

virtual_fr...tp.ps1

windows10-2004_x64

1

virtual_fr...x.html

windows7_x64

1

virtual_fr...x.html

windows10-2004_x64

1

virtual_fr...oap.js

windows7_x64

1

virtual_fr...oap.js

windows10-2004_x64

1

Analysis

  • max time kernel
    44s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    virtual_freer_v1.58/include/libs/class.smtp.ps1

  • Size

    29KB

  • MD5

    9618d989144adb4bb7b3f8e22c4039dd

  • SHA1

    33a47be4da7ff19b02cc9f4ef26f2a0148b3f6f8

  • SHA256

    2a33769f985d9cf043e92aa4fb306a6e364970c828922c8455212d822cd543b7

  • SHA512

    41f5e03a9e2fa1d31d26a3a5f4b91a118ca78d87dc8d8f5f8f0690ed191fd355ddbf80afbe1c394c709fb7dbffdf23e185fc23aecedbc73be1ef4690f958b958

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\include\libs\class.smtp.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/548-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp
    Filesize

    8KB

    Download
  • memory/548-55-0x000007FEF3F20000-0x000007FEF4943000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/548-56-0x000007FEF33C0000-0x000007FEF3F1D000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/548-57-0x00000000029A4000-0x00000000029A7000-memory.dmp
    Filesize

    12KB

    Download
  • memory/548-58-0x000000001B740000-0x000000001BA3F000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/548-59-0x00000000029AB000-0x00000000029CA000-memory.dmp
    Filesize

    124KB

    Download