Overview
overview
10Static
static
Document-1310.iso
windows7_x64
3Document-1310.iso
windows10-2004_x64
31662.ps1
windows7_x64
11662.ps1
windows10-2004_x64
10Scan_139.jpg
windows7_x64
3Scan_139.jpg
windows10-2004_x64
3Scan_139.jpg.lnk
windows7_x64
3Scan_139.jpg.lnk
windows10-2004_x64
10x.txt
windows7_x64
1x.txt
windows10-2004_x64
1Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-06-2022 19:49
Static task
static1
Behavioral task
behavioral1
Sample
Document-1310.iso
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Document-1310.iso
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
1662.ps1
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
1662.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Scan_139.jpg
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Scan_139.jpg
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
Scan_139.jpg.lnk
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
Scan_139.jpg.lnk
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
x.txt
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
x.txt
Resource
win10v2004-20220414-en
General
-
Target
1662.ps1
-
Size
192KB
-
MD5
3f5498ca9c0d3d185bc45edf45185d07
-
SHA1
f945b742489e29dff58fd41a4f6293b6deb57533
-
SHA256
caa1268740d0b48795621f8d0e127fd4574c87de5c16f5348fadc97866d1de39
-
SHA512
34849f297613c9c2b284704e65701aa88ded0ccea1956d55233a052810149b81489c4e7b6bd0416b53d394ec676221527fbe700434756ed04827b5b9bad0334c
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 952 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 952 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmpFilesize
8KB
-
memory/952-55-0x000007FEF3800000-0x000007FEF4223000-memory.dmpFilesize
10.1MB
-
memory/952-56-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmpFilesize
11.4MB
-
memory/952-57-0x000007FEF4230000-0x000007FEF510C000-memory.dmpFilesize
14.9MB
-
memory/952-58-0x000007FEF3800000-0x000007FEF4223000-memory.dmpFilesize
10.1MB
-
memory/952-60-0x00000000024C4000-0x00000000024C7000-memory.dmpFilesize
12KB
-
memory/952-59-0x000007FEF6880000-0x000007FEF6932000-memory.dmpFilesize
712KB
-
memory/952-61-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmpFilesize
11.4MB
-
memory/952-62-0x000007FEFAB90000-0x000007FEFABF9000-memory.dmpFilesize
420KB
-
memory/952-63-0x000007FEFAEC0000-0x000007FEFAEF2000-memory.dmpFilesize
200KB
-
memory/952-64-0x000007FEF66E0000-0x000007FEF678A000-memory.dmpFilesize
680KB
-
memory/952-65-0x000007FEF65F0000-0x000007FEF66D5000-memory.dmpFilesize
916KB
-
memory/952-66-0x000007FEF5F00000-0x000007FEF6116000-memory.dmpFilesize
2.1MB
-
memory/952-68-0x000007FEFAE50000-0x000007FEFAE8E000-memory.dmpFilesize
248KB
-
memory/952-67-0x000007FEF64D0000-0x000007FEF65E8000-memory.dmpFilesize
1.1MB
-
memory/952-69-0x000000001B700000-0x000000001B9FF000-memory.dmpFilesize
3.0MB
-
memory/952-70-0x000007FEF25F0000-0x000007FEF2C95000-memory.dmpFilesize
6.6MB
-
memory/952-71-0x000007FEF5C00000-0x000007FEF5D6C000-memory.dmpFilesize
1.4MB
-
memory/952-72-0x000007FEF2450000-0x000007FEF25E5000-memory.dmpFilesize
1.6MB
-
memory/952-73-0x00000000024CB000-0x00000000024EA000-memory.dmpFilesize
124KB
-
memory/952-74-0x000007FEF6120000-0x000007FEF644E000-memory.dmpFilesize
3.2MB
-
memory/952-75-0x000007FEEEA00000-0x000007FEEF24B000-memory.dmpFilesize
8.3MB
-
memory/952-76-0x000007FEF4230000-0x000007FEF510C000-memory.dmpFilesize
14.9MB
-
memory/952-77-0x000007FEF25F0000-0x000007FEF2C95000-memory.dmpFilesize
6.6MB
-
memory/952-78-0x000007FEF3800000-0x000007FEF4223000-memory.dmpFilesize
10.1MB
-
memory/952-79-0x000007FEF6880000-0x000007FEF6932000-memory.dmpFilesize
712KB
-
memory/952-80-0x00000000024C4000-0x00000000024C7000-memory.dmpFilesize
12KB
-
memory/952-81-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmpFilesize
11.4MB
-
memory/952-82-0x000007FEF5F00000-0x000007FEF6116000-memory.dmpFilesize
2.1MB
-
memory/952-83-0x000007FEF64D0000-0x000007FEF65E8000-memory.dmpFilesize
1.1MB
-
memory/952-84-0x00000000024CB000-0x00000000024EA000-memory.dmpFilesize
124KB