2a006a3dd453c03399a612c2dc11e4290636f1b39ab1187cac4981758c4a565a | Triage

Analysis

max time kernel
156s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-06-2022 07:24

Sharing

Report Analysis Logs

General

Target

xlsx/xlsx/xl/link/Excel/PO/BlackList.ps1
Size

1KB
MD5

d7a8ec808175f697f74fff16c97e2b11
SHA1

102742cdeecb33034b74b24851c80570dbc2aa29
SHA256

ac36b1a1ca21690705c69784f249175dee7355ee535d35913e8e46b6794454af
SHA512

205cd939ef9aae19c60e5378b7b50ee84d78a23e22b6450e7b4b604f182c276571568a651223267d8ec442e5e4b29ae984572b83f6fdd89956a021d29ee1ca7e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1200 powershell.exe
1200 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1200 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xlsx\xlsx\xl\link\Excel\PO\BlackList.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-130-0x000001A62CE50000-0x000001A62CE72000-memory.dmp

Filesize
136KB

Download
memory/1200-131-0x00007FF8BEC80000-0x00007FF8BF741000-memory.dmp

Filesize
10.8MB

Download