Analysis
- max time kernel
119s - max time network
130s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
21/06/2024, 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Malwarebytes-Premium-Bypass-main/Malwarebytes-Premium-Reset.bat
Resource
win11-20240611-en
windows11-21h2-x64
35 signatures
300 seconds
Behavioral task
behavioral2
Sample
Malwarebytes-Premium-Bypass-main/Malwarebytes-Premium-Reset.ps1
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
Malwarebytes-Premium-Bypass-main/SAA MalwareBytes Premium.exe
Resource
win11-20240508-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240508-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240419-en
windows11-21h2-x64
2 signatures
300 seconds
General
- Target Malwarebytes-Premium-Bypass-main/Malwarebytes-Premium-Reset.ps1
- Size 3KB
- Sample240621-vchdwssbln
- SHA256 f3ff0317c1350f199653bfd8255f1b2b05ec2f3ff0bd4bc7c5fd50fac848d502
- MD5 4b9bd4349376a4f8c79655e8af23ab7a
- SHA1 f091274b44ba15cdbd0fd3ca95756e461bbd9779
- SHA512 753543216568851281b401360089703e3652852406013ce9f036bc2af9b23f9eee7508fc7d0f5c1f6c3bb782e7bc31386976ac7d954188fa0aabfaaf1c06ff4d
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
-
pid Process 4512 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4512 powershell.exe 4512 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4512 powershell.exe Token: SeIncreaseQuotaPrivilege 4512 powershell.exe Token: SeSecurityPrivilege 4512 powershell.exe Token: SeTakeOwnershipPrivilege 4512 powershell.exe Token: SeLoadDriverPrivilege 4512 powershell.exe Token: SeSystemProfilePrivilege 4512 powershell.exe Token: SeSystemtimePrivilege 4512 powershell.exe Token: SeProfSingleProcessPrivilege 4512 powershell.exe Token: SeIncBasePriorityPrivilege 4512 powershell.exe Token: SeCreatePagefilePrivilege 4512 powershell.exe Token: SeBackupPrivilege 4512 powershell.exe Token: SeRestorePrivilege 4512 powershell.exe Token: SeShutdownPrivilege 4512 powershell.exe Token: SeDebugPrivilege 4512 powershell.exe Token: SeSystemEnvironmentPrivilege 4512 powershell.exe Token: SeRemoteShutdownPrivilege 4512 powershell.exe Token: SeUndockPrivilege 4512 powershell.exe Token: SeManageVolumePrivilege 4512 powershell.exe Token: 33 4512 powershell.exe Token: 34 4512 powershell.exe Token: 35 4512 powershell.exe Token: 36 4512 powershell.exe Token: SeIncreaseQuotaPrivilege 4512 powershell.exe Token: SeSecurityPrivilege 4512 powershell.exe Token: SeTakeOwnershipPrivilege 4512 powershell.exe Token: SeLoadDriverPrivilege 4512 powershell.exe Token: SeSystemProfilePrivilege 4512 powershell.exe Token: SeSystemtimePrivilege 4512 powershell.exe Token: SeProfSingleProcessPrivilege 4512 powershell.exe Token: SeIncBasePriorityPrivilege 4512 powershell.exe Token: SeCreatePagefilePrivilege 4512 powershell.exe Token: SeBackupPrivilege 4512 powershell.exe Token: SeRestorePrivilege 4512 powershell.exe Token: SeShutdownPrivilege 4512 powershell.exe Token: SeDebugPrivilege 4512 powershell.exe Token: SeSystemEnvironmentPrivilege 4512 powershell.exe Token: SeRemoteShutdownPrivilege 4512 powershell.exe Token: SeUndockPrivilege 4512 powershell.exe Token: SeManageVolumePrivilege 4512 powershell.exe Token: 33 4512 powershell.exe Token: 34 4512 powershell.exe Token: 35 4512 powershell.exe Token: 36 4512 powershell.exe Token: SeIncreaseQuotaPrivilege 4512 powershell.exe Token: SeSecurityPrivilege 4512 powershell.exe Token: SeTakeOwnershipPrivilege 4512 powershell.exe Token: SeLoadDriverPrivilege 4512 powershell.exe Token: SeSystemProfilePrivilege 4512 powershell.exe Token: SeSystemtimePrivilege 4512 powershell.exe Token: SeProfSingleProcessPrivilege 4512 powershell.exe Token: SeIncBasePriorityPrivilege 4512 powershell.exe Token: SeCreatePagefilePrivilege 4512 powershell.exe Token: SeBackupPrivilege 4512 powershell.exe Token: SeRestorePrivilege 4512 powershell.exe Token: SeShutdownPrivilege 4512 powershell.exe Token: SeDebugPrivilege 4512 powershell.exe Token: SeSystemEnvironmentPrivilege 4512 powershell.exe Token: SeRemoteShutdownPrivilege 4512 powershell.exe Token: SeUndockPrivilege 4512 powershell.exe Token: SeManageVolumePrivilege 4512 powershell.exe Token: 33 4512 powershell.exe Token: 34 4512 powershell.exe Token: 35 4512 powershell.exe Token: 36 4512 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Malwarebytes-Premium-Bypass-main\Malwarebytes-Premium-Reset.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zjfrubg1.bq1.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512