6fba08a0ddf1d46e3c76963c27a8c624c25cd1c08f69986a9d101b7cf13257ac

Analysis

max time kernel
141s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 22:39

Target

8969122ef3485d.ps1
Size

24KB
MD5

dbe7e2c61dae4abd32c335f281aba3bc
SHA1

ea67556c09a8d1206da53f534bbdd1d8fd90beaf
SHA256

8b1a3a5a86823d261bad786382bd1d98416022cdcbbccc9b158517fd1c3b1ec5
SHA512

adfc28a0b9e83b3b65ec1680b65a01111c2209022d3a97f2da984bb081ca0acfc1a5666c2856d447c15ecb219f8bd78c87366f70d6f413d538a387b25729a879
SSDEEP

768:GRoYsM/gzp15ILVndPrwt1mBy0XqFSJFhpre6jFwnFl:GST5IL/PkPmBlXqcLh5ljO7

Score

8^/10

Blocklisted process makes network request 8 IoCs

Processes:

powershell.exe

Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\295.lnk powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1928 powershell.exe
1928 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1928 powershell.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1108 AcroRd32.exe
1108 AcroRd32.exe
1108 AcroRd32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\295.lnk	powershell.exe

pid	process
1928	powershell.exe
1928	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1928	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1928 wrote to memory of 1108	1928	powershell.exe	AcroRd32.exe
PID 1928 wrote to memory of 1108	1928	powershell.exe	AcroRd32.exe
PID 1928 wrote to memory of 1108	1928	powershell.exe	AcroRd32.exe
PID 1928 wrote to memory of 1108	1928	powershell.exe	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\document.pdf"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1108

memory/1108-60-0x0000000000000000-mapping.dmp

Download
memory/1108-61-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1928-54-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Filesize
8KB

Download
memory/1928-55-0x000007FEF3DE0000-0x000007FEF4803000-memory.dmp

Filesize
10.1MB

Download
memory/1928-57-0x0000000002724000-0x0000000002727000-memory.dmp

Filesize
12KB

Download
memory/1928-56-0x000007FEF3280000-0x000007FEF3DDD000-memory.dmp

Filesize
11.4MB

Download
memory/1928-58-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/1928-59-0x000000000272B000-0x000000000274A000-memory.dmp

Filesize
124KB

Download
memory/1928-62-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/1928-63-0x0000000002724000-0x0000000002727000-memory.dmp

Filesize
12KB

Download
memory/1928-64-0x000000000272B000-0x000000000274A000-memory.dmp

Filesize
124KB

Download
memory/1928-65-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download