13b4ff0ebcd5f086acddfad7641e68a2e0c6a75387afed797bb39a601319d0d3

Analysis

max time kernel
72s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2023, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UAC.dll
Size

259KB
MD5

c7fe8cd979d2841aa16d8c40f1e8ecbd
SHA1

9b82bee953d827893175889a939cbfb79a446efc
SHA256

13b4ff0ebcd5f086acddfad7641e68a2e0c6a75387afed797bb39a601319d0d3
SHA512

58ebae0cf8cd202033cbdeeb0aad061b073be54a30b6d802d3800ef70ec29ef4ba51c2776a1071f8448937e0448bed04727d07b1722b9d2ead074a2f4cf3641b
SSDEEP

6144:t8rPD6rhWSOhym+vbM/RJg5ci0Sz9kpbgiuIFVQF5IcYFa:t6h5RJScAzOpbg3z5pga

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1324	powershell.exe
1324	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3312	3344	rundll32.exe	84
PID 3344 wrote to memory of 3312	3344	rundll32.exe	84
PID 3344 wrote to memory of 3312	3344	rundll32.exe	84
PID 3312 wrote to memory of 1324	3312	rundll32.exe	85
PID 3312 wrote to memory of 1324	3312	rundll32.exe	85
PID 3312 wrote to memory of 1324	3312	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\UAC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" start -windowstyle hidden -filepath 'C:\Users\Admin\AppData\Local\Temp\UAC.dll,#1'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iinjcitj.dqq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1324-139-0x0000000005F20000-0x0000000005F86000-memory.dmp

Filesize
408KB

Download
memory/1324-135-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/1324-136-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/1324-137-0x0000000005D20000-0x0000000005D42000-memory.dmp

Filesize
136KB

Download
memory/1324-138-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1324-133-0x0000000004FE0000-0x0000000005016000-memory.dmp

Filesize
216KB

Download
memory/1324-134-0x00000000056F0000-0x0000000005D18000-memory.dmp

Filesize
6.2MB

Download
memory/1324-149-0x0000000006600000-0x000000000661E000-memory.dmp

Filesize
120KB

Download
memory/1324-150-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/1324-151-0x0000000007800000-0x0000000007896000-memory.dmp

Filesize
600KB

Download
memory/1324-152-0x0000000006AF0000-0x0000000006B0A000-memory.dmp

Filesize
104KB

Download
memory/1324-153-0x0000000006B40000-0x0000000006B62000-memory.dmp

Filesize
136KB

Download
memory/1324-154-0x0000000007E50000-0x00000000083F4000-memory.dmp

Filesize
5.6MB

Download