07b4430bee4ea392505c4215adcf542e34b37f16ac11e35c7b3338eaf11c9815 | Triage

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 04:51

Sharing

Report Analysis Logs

General

Target

fix/backlogs.ps1
Size

371B
MD5

fefd1656933426b67f7d386706fa8649
SHA1

f10dd69df4dc476328f63206ee50ab69d5177ca6
SHA256

cea4bb80a795490d0ffcbba3d581d1451bc5a2743ecb15f44f815c32196d3942
SHA512

b11c8cdc587ef8ae57d9a97afdd88756c606184e217c32073aab77f261239e19d9f689f8d5d5549560fa85dc587a153f3ab2c97cc5c55cae8a974df0978ddc6c

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1892 powershell.exe
1892 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1892 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1892 wrote to memory of 3124	1892	powershell.exe	rundll32.exe
PID 1892 wrote to memory of 3124	1892	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\backlogs.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\foodStunting.jpg DrawThemeIcon
2⤵
PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-132-0x000002506B240000-0x000002506B262000-memory.dmp

Filesize
136KB

Download
memory/1892-133-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/1892-134-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/1892-136-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/3124-135-0x0000000000000000-mapping.dmp

Download