Analysis
-
max time kernel
138s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 22:39
Static task
static1
Behavioral task
behavioral1
Sample
8969122ef3485d.ps1
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8969122ef3485d.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
8969122ef3485df.ps1
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
8969122ef3485df.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
PO-12-5-2022.lnk
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
PO-12-5-2022.lnk
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
document.pdf
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
document.pdf
Resource
win10v2004-20221111-en
General
-
Target
8969122ef3485df.ps1
-
Size
424KB
-
MD5
7e17e5f94d45e854c6855f557d4c3b62
-
SHA1
dc1894577c77ea178a40510d676fc31e4049bce3
-
SHA256
d19fc72db9725c704b88f4dbf52fdc11d609d6adeedaafa8b79ca76dc7da12c2
-
SHA512
80f6dbc86f5825b5935d775614e531981fcd0d768092e83f6e364514ae6ec868b916d057c739f0cf8e2226aa5a495f72d1aafed1b9196a9ce5976994be38b6bd
-
SSDEEP
6144:cJg4cOlXYM0DPGj7fw0xB2pPBrGyMsY7iGBa5fIoYAUdfv05Xs0lHBMjMlzN0s:cu4cO+MkPGI4MpPBrCi1B+05Xll90s
Malware Config
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
powershell.exeflow pid process 4 1232 powershell.exe 5 1232 powershell.exe 6 1232 powershell.exe 7 1232 powershell.exe 8 1232 powershell.exe 9 1232 powershell.exe 10 1232 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1232 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1232 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-54-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmpFilesize
8KB
-
memory/1232-55-0x000007FEF3C50000-0x000007FEF4673000-memory.dmpFilesize
10.1MB
-
memory/1232-57-0x0000000002324000-0x0000000002327000-memory.dmpFilesize
12KB
-
memory/1232-56-0x000007FEF30F0000-0x000007FEF3C4D000-memory.dmpFilesize
11.4MB
-
memory/1232-58-0x000000000232B000-0x000000000234A000-memory.dmpFilesize
124KB
-
memory/1232-59-0x0000000002324000-0x0000000002327000-memory.dmpFilesize
12KB
-
memory/1232-60-0x000000001B130000-0x000000001B170000-memory.dmpFilesize
256KB
-
memory/1232-61-0x000000001B130000-0x000000001B170000-memory.dmpFilesize
256KB