afe40fb3150b18dbc4b46d09e57b7e30eb303969d7e5aca5315bf12788446be2 | Triage

Analysis

max time kernel
196s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 06:27

Sharing

Report Analysis Logs

General

Target

CamMute.ps1
Size

146KB
MD5

4ae94a2da16ad5ad5efc4cc13f307492
SHA1

2e049ddbbe6fe5f72ea98350739091ba88817c68
SHA256

826716e9d34cd8f0c6ed461b704f3081e8444b30236616ee1f1aec5ec1e2e1b3
SHA512

413ef4ca0b81bee6da8348f8d99de2d11be0d8afb51addb2f02a1fce90fdaddcd67e83e82c61309707f9df74bd18e45a85552c0fe876112d08769fa9c86b845a
SSDEEP

3072:FXoHtP4UwV+D0+irj4zBHkVMRckilLvlNwKCC:qHyUwVPX6hkVOcZfzCC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

5104 powershell.exe
5104 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5104 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\CamMute.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5104-132-0x0000019F72A50000-0x0000019F72A72000-memory.dmp

Filesize
136KB

Download
memory/5104-133-0x00007FFC10400000-0x00007FFC10EC1000-memory.dmp

Filesize
10.8MB

Download
memory/5104-134-0x00007FFC10400000-0x00007FFC10EC1000-memory.dmp

Filesize
10.8MB

Download