hxxps://1drv[.]ms/o/s!ALxT7EaAdsTNgx0?e=oDiyfvFUjkWOfwrZXparzA&at=9 | Triage

Analysis

max time kernel
58s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 09:35

Sharing

Report Analysis Logs

General

Target

https://1drv.ms/o/s!ALxT7EaAdsTNgx0?e=oDiyfvFUjkWOfwrZXparzA&at=9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4808	powershell.exe
4808	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://1drv.ms/o/s!ALxT7EaAdsTNgx0?e=oDiyfvFUjkWOfwrZXparzA&at=9
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-132-0x00000295C7290000-0x00000295C72B2000-memory.dmp

Filesize
136KB

Download
memory/4808-133-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Filesize
10.8MB

Download
memory/4808-134-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Filesize
10.8MB

Download