Overview

overview

7

Static

static

Lenureba.ps1

windows7_x64

1

Lenureba.ps1

windows10-2004_x64

1

Lenureba.exe

windows7_x64

3

Lenureba.exe

windows10-2004_x64

7

Analysis

  • max time kernel
    42s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-es
  • submitted
    25-05-2022 07:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Lenureba.ps1

  • Size

    153KB

  • MD5

    88695da672a8c03306b19e48b8bb5b29

  • SHA1

    62332d20678e10ea4b2f471cb7ed4a33710d6b45

  • SHA256

    7083fdcdfef7b67dde376bc5ae8ab4f230cac6d7703f4ae4115f0175484c71b1

  • SHA512

    ad0e5d3fa0f1890da52fec6f98962a52dedc2778b68d55dd0d65f3d72bab76c11527180ac48322ec767cf4dfb578bb2060732e04d2224e0045c07ab950448674

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Lenureba.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1260
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:476

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1260-54-0x000007FEFC071000-0x000007FEFC073000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1260-55-0x000007FEF36A0000-0x000007FEF41FD000-memory.dmp

      Filesize

      11.4MB

      Download

    • memory/1260-56-0x0000000002A04000-0x0000000002A07000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1260-57-0x000000001B750000-0x000000001BA4F000-memory.dmp

      Filesize

      3.0MB

      Download

    • memory/1260-58-0x0000000002A0B000-0x0000000002A2A000-memory.dmp

      Filesize

      124KB

      Download