555ef79470ddd48be26d41437e93f077a8cce8598ae896a7b9931b1c998057ce

Analysis

max time kernel
154s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.ps1
Size

2KB
MD5

926e5a0589c28d9f9df27076309b69f1
SHA1

f8a7a8376ed133b6875d4f008f49b1799b2cbe68
SHA256

a1be8ab1061d8dfa7fc2b82e256971ee110695e776e493c96625935f9143aebd
SHA512

7bdc74249e1aa22fd0ed69c7709926e7137d386d61e00c958e8f12ec060980b482a69813ce3557ddbce901ac886ff0e2b30b2ddedc7f79b6c5c73eab7ee677ea

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

1372 powershell.exe
1372 powershell.exe
5108 powershell.exe
5108 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1372 powershell.exe
Token: SeDebugPrivilege 5108 powershell.exe

pid	process
1372	powershell.exe
1372	powershell.exe
5108	powershell.exe
5108	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1372 wrote to memory of 5108	1372	powershell.exe	powershell.exe
PID 1372 wrote to memory of 5108	1372	powershell.exe	powershell.exe
PID 1372 wrote to memory of 5108	1372	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\test.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- \??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
  "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
93678e82d776686aa54c42b8a98e6cbc

SHA1
802939dfed99ac74814c4371388b204c5810241d

SHA256
da32a79a8e04cbafb1c5980b3d6225f4705010df5eb45d464cd5bf6b642d7841

SHA512
0b412a1e11c0639d72f6a58c661ecc43da021c010c4d1e66051c5a376ebab287480bbf663345c9bd2a79ec3a35a9788cf04d74d612449f76fe2c87576cd13520

Download Submit
memory/1372-141-0x00007FFD53800000-0x00007FFD542C1000-memory.dmp

Filesize
10.8MB

Download
memory/1372-131-0x00007FFD53800000-0x00007FFD542C1000-memory.dmp

Filesize
10.8MB

Download
memory/1372-132-0x0000025DF4950000-0x0000025DF4AC6000-memory.dmp

Filesize
1.5MB

Download
memory/1372-133-0x0000025DF4CE0000-0x0000025DF4EEA000-memory.dmp

Filesize
2.0MB

Download
memory/1372-130-0x0000025DF4540000-0x0000025DF4562000-memory.dmp

Filesize
136KB

Download
memory/1372-145-0x00007FFD53800000-0x00007FFD542C1000-memory.dmp

Filesize
10.8MB

Download
memory/5108-134-0x0000000000000000-mapping.dmp

Download
memory/5108-138-0x0000000005B70000-0x0000000005BD6000-memory.dmp

Filesize
408KB

Download
memory/5108-139-0x0000000005BE0000-0x0000000005C46000-memory.dmp

Filesize
408KB

Download
memory/5108-140-0x0000000006300000-0x000000000631E000-memory.dmp

Filesize
120KB

Download
memory/5108-137-0x00000000053A0000-0x00000000053C2000-memory.dmp

Filesize
136KB

Download
memory/5108-136-0x0000000005410000-0x0000000005A38000-memory.dmp

Filesize
6.2MB

Download
memory/5108-143-0x0000000007210000-0x000000000788A000-memory.dmp

Filesize
6.5MB

Download
memory/5108-144-0x0000000006840000-0x000000000685A000-memory.dmp

Filesize
104KB

Download
memory/5108-135-0x0000000002CD0000-0x0000000002D06000-memory.dmp

Filesize
216KB

Download