4ce24c022e799db363340739967bfe40edc4ed1d81588a86007eb16c8ec601e7

Analysis

max time kernel
177s
max time network
196s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:45

Target

8969122ef3485d.ps1
Size

24KB
MD5

dbe7e2c61dae4abd32c335f281aba3bc
SHA1

ea67556c09a8d1206da53f534bbdd1d8fd90beaf
SHA256

8b1a3a5a86823d261bad786382bd1d98416022cdcbbccc9b158517fd1c3b1ec5
SHA512

adfc28a0b9e83b3b65ec1680b65a01111c2209022d3a97f2da984bb081ca0acfc1a5666c2856d447c15ecb219f8bd78c87366f70d6f413d538a387b25729a879
SSDEEP

768:GRoYsM/gzp15ILVndPrwt1mBy0XqFSJFhpre6jFwnFl:GST5IL/PkPmBlXqcLh5ljO7

Score

8^/10

Blocklisted process makes network request 7 IoCs

Processes:

powershell.exe

flow pid process

4 848 powershell.exe
5 848 powershell.exe
6 848 powershell.exe
7 848 powershell.exe
8 848 powershell.exe
9 848 powershell.exe
10 848 powershell.exe
Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\295.lnk powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

848 powershell.exe
848 powershell.exe
848 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 848 powershell.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

520 AcroRd32.exe
520 AcroRd32.exe
520 AcroRd32.exe
520 AcroRd32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\295.lnk	powershell.exe

description	pid	process
Token: SeDebugPrivilege	848	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 848 wrote to memory of 520	848	powershell.exe	AcroRd32.exe
PID 848 wrote to memory of 520	848	powershell.exe	AcroRd32.exe
PID 848 wrote to memory of 520	848	powershell.exe	AcroRd32.exe
PID 848 wrote to memory of 520	848	powershell.exe	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\document.pdf"
2⤵
- Suspicious use of SetWindowsHookEx
PID:520

memory/520-58-0x0000000000000000-mapping.dmp

Download
memory/520-59-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/848-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/848-55-0x000007FEF4070000-0x000007FEF4A93000-memory.dmp

Filesize
10.1MB

Download
memory/848-56-0x000007FEF3510000-0x000007FEF406D000-memory.dmp

Filesize
11.4MB

Download
memory/848-57-0x00000000024C4000-0x00000000024C7000-memory.dmp

Filesize
12KB

Download
memory/848-60-0x00000000024CB000-0x00000000024EA000-memory.dmp

Filesize
124KB

Download
memory/848-61-0x000000001B9F0000-0x000000001BA30000-memory.dmp

Filesize
256KB

Download
memory/848-62-0x00000000024C4000-0x00000000024C7000-memory.dmp

Filesize
12KB

Download
memory/848-63-0x00000000024CB000-0x00000000024EA000-memory.dmp

Filesize
124KB

Download
memory/848-64-0x000000001B9F0000-0x000000001BA30000-memory.dmp

Filesize
256KB

Download