3aac32ecf3dc6c3cc6134ebff428b39f2ca7e60135d750b530028b13d1e11a47 | Triage

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 10:39

Sharing

Report Analysis Logs

General

Target

requirements.scr
Size

1.7MB
MD5

79fa39ca211a380dc98c482efc464d80
SHA1

18f708df88acc2bfcbf4c0c92e592e07c163d579
SHA256

3aac32ecf3dc6c3cc6134ebff428b39f2ca7e60135d750b530028b13d1e11a47
SHA512

112e085a5aa9c47f3613b6ff8d0d9c637f0bd53f8001a37b52199d10a01dcedf702a445ac0f6ff2eb4e8e3fecc3d586417d74943e05321ef9ef816092ec0daca
SSDEEP

6144:zK1RwjnNcXRMdFoMXtYBX2q+QG1MZRVC1/EoUHxyJwq5m1IP:jjnihOdQY0ia1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

764 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 764 powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

requirements.scr

description	pid	process	target process
PID 1504 wrote to memory of 764	1504	requirements.scr	powershell.exe
PID 1504 wrote to memory of 764	1504	requirements.scr	powershell.exe
PID 1504 wrote to memory of 764	1504	requirements.scr	powershell.exe
PID 1504 wrote to memory of 764	1504	requirements.scr	powershell.exe

C:\Users\Admin\AppData\Local\Temp\requirements.scr
"C:\Users\Admin\AppData\Local\Temp\requirements.scr" /S
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-56-0x0000000000000000-mapping.dmp

Download
memory/764-58-0x000000006FD50000-0x00000000702FB000-memory.dmp

Filesize
5.7MB

Download
memory/764-59-0x000000006FD50000-0x00000000702FB000-memory.dmp

Filesize
5.7MB

Download
memory/1504-54-0x0000000000370000-0x00000000003BC000-memory.dmp

Filesize
304KB

Download
memory/1504-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download