2a006a3dd453c03399a612c2dc11e4290636f1b39ab1187cac4981758c4a565a | Triage

Analysis

max time kernel
161s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-06-2022 07:24

Sharing

Report Analysis Logs

General

Target

xlsx/xlsx/xl/link/Excel/BlackList.ps1
Size

1KB
MD5

d7a8ec808175f697f74fff16c97e2b11
SHA1

102742cdeecb33034b74b24851c80570dbc2aa29
SHA256

ac36b1a1ca21690705c69784f249175dee7355ee535d35913e8e46b6794454af
SHA512

205cd939ef9aae19c60e5378b7b50ee84d78a23e22b6450e7b4b604f182c276571568a651223267d8ec442e5e4b29ae984572b83f6fdd89956a021d29ee1ca7e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

516 powershell.exe
516 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 516 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xlsx\xlsx\xl\link\Excel\BlackList.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-131-0x0000019F49910000-0x0000019F49932000-memory.dmp

Filesize
136KB

Download
memory/516-132-0x00007FF902720000-0x00007FF9031E1000-memory.dmp

Filesize
10.8MB

Download
memory/516-133-0x00007FF902720000-0x00007FF9031E1000-memory.dmp

Filesize
10.8MB

Download