hxxp://URL[:] hxxps://alignedenergy[.]zengrc[.]com/survey/view/79b8919d-432b-47f1-929f-3a3fe5e85269/ | Triage

Analysis

max time kernel
51s
max time network
1588s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
11/02/2023, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://URL: https://alignedenergy.zengrc.com/survey/view/79b8919d-432b-47f1-929f-3a3fe5e85269/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3520	powershell.exe
3520	powershell.exe
3520	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge "http://URL: https://alignedenergy.zengrc.com/survey/view/79b8919d-432b-47f1-929f-3a3fe5e85269/"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-120-0x00000272AB9A0000-0x00000272AB9C2000-memory.dmp

Filesize
136KB

Download
memory/3520-123-0x00000272C4080000-0x00000272C40F6000-memory.dmp

Filesize
472KB

Download