072780a8e01445c4860453048a21ecf956a66a9bc5765065fee827ca6b88b8f6

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
31-05-2022 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loki 1.8/Panel/inc/class/pCharts/class/pDraw.class.ps1
Size

319KB
MD5

0b9bbffe4c457652343862347e1357ef
SHA1

23d4591b018f5d133ecdff92e387877b0845b432
SHA256

97201d530c4745751246ed4639cf24e3342ce0a4a3de885b2e969e1cdc1bf3db
SHA512

20cd48f0119681a925950eb5771cb884eb5a8e980d8e931df130320febd99724cb66e0c4f5cbd6a2f7e1ee190a7f505a5a5426e0831daae6d817b1bbdfa9a149

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1488 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1488 powershell.exe

pid	process
1488	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1488	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Loki 1.8\Panel\inc\class\pCharts\class\pDraw.class.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Filesize
8KB

Download
memory/1488-55-0x000007FEF4A90000-0x000007FEF54B3000-memory.dmp

Filesize
10.1MB

Download
memory/1488-56-0x000007FEF3F30000-0x000007FEF4A8D000-memory.dmp

Filesize
11.4MB

Download
memory/1488-57-0x000007FEF54C0000-0x000007FEF639C000-memory.dmp

Filesize
14.9MB

Download
memory/1488-58-0x000007FEF4A90000-0x000007FEF54B3000-memory.dmp

Filesize
10.1MB

Download
memory/1488-59-0x000007FEF6FC0000-0x000007FEF7072000-memory.dmp

Filesize
712KB

Download
memory/1488-60-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1488-61-0x000007FEF3F30000-0x000007FEF4A8D000-memory.dmp

Filesize
11.4MB

Download
memory/1488-62-0x000007FEF3C00000-0x000007FEF3F2E000-memory.dmp

Filesize
3.2MB

Download
memory/1488-63-0x000007FEF77C0000-0x000007FEF7829000-memory.dmp

Filesize
420KB

Download
memory/1488-64-0x000007FEF7210000-0x000007FEF7242000-memory.dmp

Filesize
200KB

Download
memory/1488-65-0x000007FEF6F10000-0x000007FEF6FBA000-memory.dmp

Filesize
680KB

Download
memory/1488-66-0x000007FEF6E20000-0x000007FEF6F05000-memory.dmp

Filesize
916KB

Download
memory/1488-68-0x000007FEF38C0000-0x000007FEF39D8000-memory.dmp

Filesize
1.1MB

Download
memory/1488-67-0x000007FEF39E0000-0x000007FEF3BF6000-memory.dmp

Filesize
2.1MB

Download
memory/1488-69-0x000007FEF71D0000-0x000007FEF720E000-memory.dmp

Filesize
248KB

Download
memory/1488-71-0x000007FEF3080000-0x000007FEF3725000-memory.dmp

Filesize
6.6MB

Download
memory/1488-70-0x000007FEF4A90000-0x000007FEF54B3000-memory.dmp

Filesize
10.1MB

Download
memory/1488-73-0x000007FEF2F10000-0x000007FEF307C000-memory.dmp

Filesize
1.4MB

Download
memory/1488-72-0x000007FEF6FC0000-0x000007FEF7072000-memory.dmp

Filesize
712KB

Download
memory/1488-74-0x000007FEF2D70000-0x000007FEF2F05000-memory.dmp

Filesize
1.6MB

Download
memory/1488-75-0x000007FEF2520000-0x000007FEF2D6B000-memory.dmp

Filesize
8.3MB

Download
memory/1488-76-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1488-77-0x000007FEF3F30000-0x000007FEF4A8D000-memory.dmp

Filesize
11.4MB

Download
memory/1488-78-0x000007FEF54C0000-0x000007FEF639C000-memory.dmp

Filesize
14.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads