732551a1d5097426140ce31fae1be56a76a8e4e1fe7f3f8f881541fb75f0df0a

Resubmissions

24-10-2023 18:49

24-10-2023 18:43

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2023 18:43

Target

mtk.exe
Size

4.1MB
MD5

70c30480eb06b0183743d108788a2f2c
SHA1

84e4960ed1fad36636dde2be095e4ef330ba80e8
SHA256

732551a1d5097426140ce31fae1be56a76a8e4e1fe7f3f8f881541fb75f0df0a
SHA512

88f1555af06d66b62709e8f34241f14e9fdbdc56ee1aa847923509e2794637cee751d7e67993339542d9730f6953d5f96a8dec3e0e0b7cd3961c31f5086422b9
SSDEEP

49152:yJztu88Rw5yLMmRBOCWRgC4NqFgyMnQHhvwnKhTcF5UHsn3A1DNekUEmZT:tjFnkwssn3AN8E8T

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

4860 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4860 powershell.exe

pid	process
4860	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4860	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

mtk.exe

description	pid	process	target process
PID 1324 wrote to memory of 4860	1324	mtk.exe	powershell.exe
PID 1324 wrote to memory of 4860	1324	mtk.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\mtk.exe
"C:\Users\Admin\AppData\Local\Temp\mtk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\e5bb106e-62e0-428a-91e9-862ce788f47b.ps1'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4860

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3qvlhoe.bbj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4860-6-0x000002779D6E0000-0x000002779D702000-memory.dmp

Filesize
136KB

Download
memory/4860-12-0x00007FFECCC30000-0x00007FFECD6F1000-memory.dmp

Filesize
10.8MB

Download
memory/4860-13-0x00007FFECCC30000-0x00007FFECD6F1000-memory.dmp

Filesize
10.8MB

Download