Behavioral Report

Analysis

max time kernel
75s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:39

Target

requirements.scr
Size

1MB
MD5

79fa39ca211a380dc98c482efc464d80
SHA1

18f708df88acc2bfcbf4c0c92e592e07c163d579
SHA256

3aac32ecf3dc6c3cc6134ebff428b39f2ca7e60135d750b530028b13d1e11a47
SHA512

112e085a5aa9c47f3613b6ff8d0d9c637f0bd53f8001a37b52199d10a01dcedf702a445ac0f6ff2eb4e8e3fecc3d586417d74943e05321ef9ef816092ec0daca
SSDEEP

6144:zK1RwjnNcXRMdFoMXtYBX2q+QG1MZRVC1/EoUHxyJwq5m1IP:jjnihOdQY0ia1

Score

8^/10

Blocklisted process makes network request ⋅ 1 IoCs

Processes:

powershell.exe

flow pid process

17 4804 powershell.exe
Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs

Processes:

powershell.exe

pid process

4804 powershell.exe
4804 powershell.exe
Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4804 powershell.exe

flow	pid	process
17	4804	powershell.exe

pid	process
4804	powershell.exe
4804	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4804	powershell.exe

Suspicious use of WriteProcessMemory ⋅ 3 IoCs

Processes:

requirements.scr

description	pid	process	target process
PID 5056 wrote to memory of 4804	5056	requirements.scr	powershell.exe
PID 5056 wrote to memory of 4804	5056	requirements.scr	powershell.exe
PID 5056 wrote to memory of 4804	5056	requirements.scr	powershell.exe

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00

memory/4804-141-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/4804-140-0x0000000005420000-0x0000000005486000-memory.dmp

Filesize
408KB

Download
memory/4804-146-0x0000000007000000-0x000000000701A000-memory.dmp

Filesize
104KB

Download
memory/4804-145-0x0000000007660000-0x0000000007CDA000-memory.dmp

Filesize
6MB

Download
memory/4804-136-0x0000000000000000-mapping.dmp

Download
memory/4804-137-0x0000000002380000-0x00000000023B6000-memory.dmp

Filesize
216KB

Download
memory/4804-144-0x0000000006D60000-0x0000000006DD6000-memory.dmp

Filesize
472KB

Download
memory/4804-139-0x0000000004C90000-0x0000000004CB2000-memory.dmp

Filesize
136KB

Download
memory/4804-138-0x0000000004DF0000-0x0000000005418000-memory.dmp

Filesize
6MB

Download
memory/4804-143-0x0000000006200000-0x0000000006244000-memory.dmp

Filesize
272KB

Download
memory/4804-142-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Filesize
120KB

Download
memory/5056-132-0x0000000000C20000-0x0000000000C6C000-memory.dmp

Filesize
304KB

Download
memory/5056-133-0x0000000005CB0000-0x0000000006254000-memory.dmp

Filesize
5MB

Download
memory/5056-135-0x00000000056A0000-0x00000000056AA000-memory.dmp

Filesize
40KB

Download
memory/5056-134-0x00000000055F0000-0x0000000005682000-memory.dmp

Filesize
584KB

Download