5fba92b48687b8cbaf19410ed222c6a77443bb146ffbcdf432c7d59381ca1567

Resubmissions

21/04/2023, 18:11

230421-wslxpahc47 3

21/04/2023, 17:23

230421-vylnfaha68 3

21/04/2023, 17:21

230421-vxcddaha62 1

Analysis

max time kernel
64s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2023, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ACMobile.UWP_3.13.9.0_Test/Dependencies/x86/Microsoft.VCLibs.x86.14.00.appx
Size

706KB
MD5

52361a9580de62654c96dd2a3e509084
SHA1

08f835f3ec02d73ac2c20933fd4ddea746062f2f
SHA256

6ea9bc40732dde6200e9ee0d027a8907ccc9dca71b3734e9546f182f342963fc
SHA512

849757b1cb90e009fe15164c924c7ad263905b7487f378176f2fba84848423367d9fe61236f65780d9df7227fe858693ff5dd0013c568be2e222da287749d32c
SSDEEP

12288:+o1kxWAVmnKUisNz96woPfBmucK/DTBUmPsG9SKt8GFiRlsBZrX+tOc:FGvVmnKSNz96fHBD9bPsG5VFQPV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1164	powershell.exe
1164	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:AppsFolder\Get-Content : Cannot find path 'C:\AppxManifest.xml' because it does not exist. At line:1 char:851 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (C:\AppxManifest.xml:String) [Get-Content], ItemNotFoundException + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe' is denied. At line:1 char:851 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Program File...__8wekyb3d8bbwe:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30035.0_x86__8wekyb3d8bbwe' is denied. At line:1 char:851 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Program File...__8wekyb3d8bbwe:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Microsoft.VCLibs.140.00_8wekyb3d8bbwe Microsoft.VCLibs.140.00_8wekyb3d8bbwe !
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ae1mjwkx.2eh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1164-133-0x0000024CCB990000-0x0000024CCB9B2000-memory.dmp

Filesize
136KB

Download
memory/1164-143-0x0000024CCABD0000-0x0000024CCABE0000-memory.dmp

Filesize
64KB

Download
memory/1164-144-0x0000024CCABD0000-0x0000024CCABE0000-memory.dmp

Filesize
64KB

Download
memory/1164-145-0x0000024CCABD0000-0x0000024CCABE0000-memory.dmp

Filesize
64KB

Download
memory/1164-147-0x0000024CCABD0000-0x0000024CCABE0000-memory.dmp

Filesize
64KB

Download
memory/1164-148-0x0000024CCABD0000-0x0000024CCABE0000-memory.dmp

Filesize
64KB

Download