Behavioral Report

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 10:39

Target

requirements.scr
Size

1MB
MD5

79fa39ca211a380dc98c482efc464d80
SHA1

18f708df88acc2bfcbf4c0c92e592e07c163d579
SHA256

3aac32ecf3dc6c3cc6134ebff428b39f2ca7e60135d750b530028b13d1e11a47
SHA512

112e085a5aa9c47f3613b6ff8d0d9c637f0bd53f8001a37b52199d10a01dcedf702a445ac0f6ff2eb4e8e3fecc3d586417d74943e05321ef9ef816092ec0daca
SSDEEP

6144:zK1RwjnNcXRMdFoMXtYBX2q+QG1MZRVC1/EoUHxyJwq5m1IP:jjnihOdQY0ia1

Score

1^/10

Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs

Processes:

powershell.exe

pid process

764 powershell.exe
Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 764 powershell.exe

pid	process
764	powershell.exe

description	pid	process
Token: SeDebugPrivilege	764	powershell.exe

Suspicious use of WriteProcessMemory ⋅ 4 IoCs

Processes:

requirements.scr

description	pid	process	target process
PID 1504 wrote to memory of 764	1504	requirements.scr	powershell.exe
PID 1504 wrote to memory of 764	1504	requirements.scr	powershell.exe
PID 1504 wrote to memory of 764	1504	requirements.scr	powershell.exe
PID 1504 wrote to memory of 764	1504	requirements.scr	powershell.exe

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00

memory/764-56-0x0000000000000000-mapping.dmp

Download
memory/764-58-0x000000006FD50000-0x00000000702FB000-memory.dmp

Filesize
5MB

Download
memory/764-59-0x000000006FD50000-0x00000000702FB000-memory.dmp

Filesize
5MB

Download
memory/1504-54-0x0000000000370000-0x00000000003BC000-memory.dmp

Filesize
304KB

Download
memory/1504-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download