Overview
overview
6Static
static
1PassMark P...se.ps1
windows7-x64
1PassMark P...se.ps1
windows10-2004-x64
1PassMark P...32.exe
windows7-x64
1PassMark P...32.exe
windows10-2004-x64
1PassMark P...64.exe
windows7-x64
1PassMark P...64.exe
windows10-2004-x64
1PassMark P...32.exe
windows7-x64
1PassMark P...32.exe
windows10-2004-x64
1PassMark P...64.exe
windows7-x64
1PassMark P...64.exe
windows10-2004-x64
1PassMark P...st.exe
windows7-x64
1PassMark P...st.exe
windows10-2004-x64
1PassMark P...32.exe
windows7-x64
1PassMark P...32.exe
windows10-2004-x64
1PassMark P...64.exe
windows7-x64
1PassMark P...64.exe
windows10-2004-x64
1PassMark P...32.exe
windows7-x64
1PassMark P...32.exe
windows10-2004-x64
1PassMark P...64.exe
windows7-x64
1PassMark P...64.exe
windows10-2004-x64
1PassMark P...st.exe
windows7-x64
1PassMark P...st.exe
windows10-2004-x64
1PassMark P...ty.exe
windows7-x64
1PassMark P...ty.exe
windows10-2004-x64
1PassMark P...st.exe
windows7-x64
1PassMark P...st.exe
windows10-2004-x64
1PassMark P...32.exe
windows7-x64
6PassMark P...32.exe
windows10-2004-x64
6PassMark P...64.exe
windows7-x64
6PassMark P...64.exe
windows10-2004-x64
6PassMark P...lp.exe
windows7-x64
3PassMark P...lp.exe
windows10-2004-x64
3Analysis
-
max time kernel
20s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26-03-2023 15:44
Static task
static1
Behavioral task
behavioral1
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/Media/SpaceBattle/SF_CargoShip-G5-Diffuse.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/Media/SpaceBattle/SF_CargoShip-G5-Diffuse.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-BulletPhysics32.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-BulletPhysics32.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-BulletPhysics64.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-BulletPhysics64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-CPUTest32.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-CPUTest32.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-CPUTest64.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-CPUTest64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-D3D11Test.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-D3D11Test.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-D3D12Test32.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-D3D12Test32.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-D3D12Test64.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-D3D12Test64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-DatabaseTest32.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-DatabaseTest32.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-DatabaseTest64.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-DatabaseTest64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-InternetSpeedTest.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-InternetSpeedTest.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-NBodyGravity.exe
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-NBodyGravity.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-PDFTest.exe
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PT-PDFTest.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PerformanceTest32.exe
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PerformanceTest32.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PerformanceTest64.exe
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PerformanceTest64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PerformanceTest_Help.exe
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/PerformanceTest_Help.exe
Resource
win10v2004-20230220-en
General
-
Target
PassMark PerformanceTest 10.2.1008 Portable/App/PerformanceTest/Media/SpaceBattle/SF_CargoShip-G5-Diffuse.ps1
-
Size
682KB
-
MD5
7619f2d7ffa8b0bef89c7aff752f852f
-
SHA1
076935f6b86f70e479f7645a634492a1454ed2c9
-
SHA256
38a069a7d10b39c4a3a925f3cb7f2ad4363f5376dd1a34a949b168137c4390cd
-
SHA512
eb8790493f653f9a0a74b72ea584d8ce7db8860d7a7a0d51d4a034b92e11e55f57da92f537fcf5e391ba97f182a61cef4758f067dd8d72fb6dbea49d2a6e24b3
-
SSDEEP
12288:8vaSp0KK0EP01OzZ4IEGu41OsE35rD2iryFgO0XFYE9avVSwuti8DoPvnz:maSp4W5/2ir99FavVwiKA7
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2040 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\PassMark PerformanceTest 10.2.1008 Portable\App\PerformanceTest\Media\SpaceBattle\SF_CargoShip-G5-Diffuse.ps1"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2040-58-0x000000001B180000-0x000000001B462000-memory.dmpFilesize
2.9MB
-
memory/2040-59-0x0000000002090000-0x0000000002098000-memory.dmpFilesize
32KB
-
memory/2040-60-0x0000000002874000-0x0000000002877000-memory.dmpFilesize
12KB
-
memory/2040-61-0x000000000287B000-0x00000000028B2000-memory.dmpFilesize
220KB