2a006a3dd453c03399a612c2dc11e4290636f1b39ab1187cac4981758c4a565a | Triage

Analysis

max time kernel
199s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-06-2022 07:24

Sharing

Report Analysis Logs

General

Target

xlsx/xlsx/xl/link/Excel/PO/block.ps1
Size

1KB
MD5

5116adad80c341b85d93671a323a55af
SHA1

59918eb53b6d37cd6052f33812fca9a05fdf883e
SHA256

b7121cded6b3c0d4ce457605b757087545bbb0e9339101e86ee46530c496d170
SHA512

471948ccbffbe950dc04cae1c4ce8648cdc5321568ee4102426fc086a20452294dd3fd3c56e79c384ffe20d40962da2b1a12f6f2e5ffc1929ae9803362b3fa8f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2340 powershell.exe
2340 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2340 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xlsx\xlsx\xl\link\Excel\PO\block.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-130-0x0000027DEE7D0000-0x0000027DEE7F2000-memory.dmp

Filesize
136KB

Download
memory/2340-131-0x00007FF8A2C80000-0x00007FF8A3741000-memory.dmp

Filesize
10.8MB

Download
memory/2340-132-0x00007FF8A2C80000-0x00007FF8A3741000-memory.dmp

Filesize
10.8MB

Download