f190a7ada80f053d8d2f5789bc98eb4f407fb82bf92393c4e79d4c25d39b4897

General

Target

trigger.ps1
Size

2KB
MD5

7b150dfd7f9f90d7af3a77734019916a
SHA1

c750d88b81a6c70bf64db62e55c32220a1e24e44
SHA256

f190a7ada80f053d8d2f5789bc98eb4f407fb82bf92393c4e79d4c25d39b4897
SHA512

9c26aeb7513f32aeb0ac4edcabf3fda92077b4a625bfbc2aaba48b7f458872d9cb45cb7b203605858b6d82f8d99c2c3788b88814eb4f142c0c2f802933f85691

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4080	powershell.exe
4080	powershell.exe
4632	powershell.exe
4632	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4632	4080	powershell.exe	81
PID 4080 wrote to memory of 4632	4080	powershell.exe	81

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process powershell -Wait "-WindowStyle hidden" -ArgumentList \ -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAZgB1AG4AYwB0AGkAbwBuACAARABlAGMAbwBtAHAAcgBlAHMAcwAtAEcAWgBpAHAAKAAkAGkAbgBmAGkAbABlACwAIAAkAG8AdQB0AGYAaQBsAGUAKQAgAHsACgAgACAAIAAgACQAaQBuAFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAUwB0AHIAZQBhAG0AIAAkAGkAbgBmAGkAbABlACwAIAAoAFsASQBPAC4ARgBpAGwAZQBNAG8AZABlAF0AOgA6AE8AcABlAG4AKQAsACAAKABbAEkATwAuAEYAaQBsAGUAQQBjAGMAZQBzAHMAXQA6ADoAUgBlAGEAZAApACwAIAAoAFsASQBPAC4ARgBpAGwAZQBTAGgAYQByAGUAXQA6ADoAUgBlAGEAZAApAAoAIAAgACAAIAAkAGcAegBpAHAAUwB0AHIAZQBhAG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAaQBuAFMAdAByAGUAYQBtACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApAAoAIAAgACAAIAAkAG8AdQB0AFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAUwB0AHIAZQBhAG0AIAAkAG8AdQB0AGYAaQBsAGUALAAgACgAWwBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoAQwByAGUAYQB0AGUAKQAsACAAKABbAEkATwAuAEYAaQBsAGUAQQBjAGMAZQBzAHMAXQA6ADoAVwByAGkAdABlACkALAAgACgAWwBJAE8ALgBGAGkAbABlAFMAaABhAHIAZQBdADoAOgBOAG8AbgBlACkACgAgACAAIAAgACQAYgB1AGYAZgBlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACgAMQAwADIANAApAAoAIAAgACAAIAB3AGgAaQBsAGUAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJAByAGUAYQBkACAAPQAgACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAdQBmAGYAZQByACwAIAAwACwAIAAxADAAMgA0ACkACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBhAGQAIAAtAGwAZQAgADAAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgACQAbwB1AHQAUwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAGIAdQBmAGYAZQByACwAIAAwACwAIAAkAHIAZQBhAGQAKQAKACAAIAAgACAAfQAKACAAIAAgACAAJABnAHoAaQBwAFMAdAByAGUAYQBtAC4AQwBsAG8AcwBlACgAKQAKACAAIAAgACAAJABvAHUAdABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAfQAKACAAIABEAGUAYwBvAG0AcAByAGUAcwBzAC0ARwBaAGkAcAAgAC0AaQBuAGYAaQBsAGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHIAaAAxADEANQAxAFwAZQBwAGkAMgBtAGUAbABhAGIAcwBcAGIAaQBuAFwAZQBwAGkAMgBtAGUALgB0AGEAcgAuAGcAegAiACAALQBvAHUAdABmAGkAbABlACAAIgBDADoAXABVAHMAZQByAHMAXAByAGgAMQAxADUAMQBcAGUAcABpADIAbQBlAGwAYQBiAHMAXABiAGkAbgBcAGUAcABpADIAbQBlAC4AdABhAHIAIgAKACAAIAA=\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
88dc70c361a22feac57b031dd9c1f02f

SHA1
a9b4732260c2a323750022a73480f229ce25d46d

SHA256
43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

SHA512
19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_misbg4mt.ukw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4080-0-0x0000020A27670000-0x0000020A27692000-memory.dmp

Filesize
136KB

Download
memory/4080-12-0x0000020A276A0000-0x0000020A276B0000-memory.dmp

Filesize
64KB

Download
memory/4080-11-0x0000020A276A0000-0x0000020A276B0000-memory.dmp

Filesize
64KB

Download
memory/4080-10-0x0000020A276A0000-0x0000020A276B0000-memory.dmp

Filesize
64KB

Download
memory/4080-9-0x00007FFFC8E40000-0x00007FFFC9902000-memory.dmp

Filesize
10.8MB

Download
memory/4080-29-0x00007FFFC8E40000-0x00007FFFC9902000-memory.dmp

Filesize
10.8MB

Download
memory/4632-21-0x00007FFFC8E40000-0x00007FFFC9902000-memory.dmp

Filesize
10.8MB

Download
memory/4632-22-0x000001ACDEDE0000-0x000001ACDEDF0000-memory.dmp

Filesize
64KB

Download
memory/4632-25-0x00007FFFC8E40000-0x00007FFFC9902000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads