36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Resubmissions

05-11-2022 18:55

221105-xkt4rshbd4 1

05-11-2022 14:56

221105-sa44rsgch3 1

Analysis

max time kernel
53s
max time network
60s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
05-11-2022 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

target.ps1
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

control.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings control.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2752 powershell.exe
2752 powershell.exe
2752 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	control.exe

pid	process
2752	powershell.exe
2752	powershell.exe
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.execontrol.exe

description	pid	process
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeShutdownPrivilege	4320	control.exe
Token: SeCreatePagefilePrivilege	4320	control.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" SYSTEM
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-124-0x000001C1BDF50000-0x000001C1BDF72000-memory.dmp

Filesize
136KB

Download
memory/2752-127-0x000001C1BE100000-0x000001C1BE176000-memory.dmp

Filesize
472KB

Download
memory/4340-131-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-132-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-133-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-134-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-135-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-136-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-137-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-138-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-139-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-140-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-141-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-142-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-143-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-144-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-145-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-146-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-147-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-149-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-148-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-150-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-151-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-152-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-153-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-154-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-155-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-156-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-157-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-158-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-159-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-160-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-161-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-162-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-163-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-164-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-165-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-166-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-167-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download
memory/4340-168-0x00000000772C0000-0x000000007744E000-memory.dmp

Filesize
1.6MB

Download