Overview
overview
10Static
static
f5068e95e1...T1.exe
windows10-2004_x64
10f5068e95e1...dH.exe
windows10-2004_x64
10f5068e95e1...ty.ps1
windows10-2004_x64
1f5068e95e1...st.exe
windows10-2004_x64
1f5068e95e1...cb.exe
windows10-2004_x64
10f5068e95e1...ry.ps1
windows10-2004_x64
1f5068e95e1...ue.ps1
windows10-2004_x64
1f5068e95e1...me.ps1
windows10-2004_x64
1f5068e95e1...ry.ps1
windows10-2004_x64
1f5068e95e1...ue.ps1
windows10-2004_x64
1f5068e95e1...ry.ps1
windows10-2004_x64
1f5068e95e1...me.ps1
windows10-2004_x64
1f5068e95e1...ue.ps1
windows10-2004_x64
1f5068e95e1...UI.exe
windows10-2004_x64
1f5068e95e1...nl.ps1
windows10-2004_x64
1f5068e95e1...wp.exe
windows10-2004_x64
1f5068e95e1...zg.exe
windows10-2004_x64
10f5068e95e1...st.exe
windows10-2004_x64
1f5068e95e1...tb.exe
windows10-2004_x64
10f5068e95e1...ar.exe
windows10-2004_x64
10Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-06-2022 21:38
Static task
static1
Behavioral task
behavioral1
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral2
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/BIozhqydH.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/CL_Utility.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral4
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/DismHost.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/IoJbxlqcb.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral6
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_AdminDiagnosticHistory.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_MachineWERQueue.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral8
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_SyncSystemTime.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_UserDiagnosticHistory.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral10
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_UserWERQueue.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_DiagnosticHistory.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral12
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_InaccurateSystemTime.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_WERQueue.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral14
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/Video.UI.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/__PSScriptPolicyTest_eg4nc2yx.0nl.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral16
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/aspnet_wp.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/esfctKdzg.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral18
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/smsvchost.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/w..orIFtb.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral20
Sample
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/xpertwar.exe
Resource
win10v2004-20220414-en
General
-
Target
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_UserDiagnosticHistory.ps1
-
Size
1KB
-
MD5
3a3ea51ac79c212f298ed11e5312f4ef
-
SHA1
cb67bddd6c00e37386c5c92f1dc18c21f7f46c9f
-
SHA256
4ab9317a0aae09510c150918c1757c7492c93606268a5e33f56031c244632a5a
-
SHA512
1387a95b2258690e25d070a79b0729c434adde52a6803562e9bbe2b6ed2acd22056693e77075d37d7e64c2c7290818af150f8689987728f5d41ff40f63c6fba3
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4276 powershell.exe 4276 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4276 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4\Downloaded_files\RS_UserDiagnosticHistory.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken