69e882f666292763b83e44d3c044644a9b2b807964db3bf36ed715d004a24fe3 | Triage

Analysis

max time kernel
119s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2022 06:59

Sharing

Report Analysis Logs

General

Target

command":["\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" ","\"C:\\Program Files\\Go.ps1
Size

551B
MD5

0e6c38286f2b07ba48f545189e34bc4a
SHA1

6228334f37ba8fbdb7121ba3df0087a18e41c07c
SHA256

69e882f666292763b83e44d3c044644a9b2b807964db3bf36ed715d004a24fe3
SHA512

1b67a3979e81b4984690223ab57b89cf94deeca348275125d3611e6064a27d25cdb069ae20967bb92b559752010755c64c74c2a2e9b3e61cdfb111dfd25a2f51

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

868 powershell.exe
868 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 868 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\command__[_\_C_\Program Files\Google\Chrome\Application\chrome.exe\_ _,_\_C_\Program Files\Go.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-132-0x000002453CB60000-0x000002453CB82000-memory.dmp

Filesize
136KB

Download
memory/868-133-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download
memory/868-134-0x00007FFDE02F0000-0x00007FFDE0DB1000-memory.dmp

Filesize
10.8MB

Download