beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9

max time kernel
575s
max time network
585s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
Size

8.5MB
MD5

2d690d32e637c43a18aa8f4f2fd28e48
SHA1

f8a5f75a34d2751c0e7195cd4adabddc1ece465e
SHA256

beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
SHA512

2641192c4ebb0a66fdf6a9be16ccfc38a4cd98a32467d5b6e719c73b2893a28888b7c9c77d3db3a0d2e93d14408081bdc92238dc3a5b1479229843f354c7305e
SSDEEP

196608:exCyu9hdCjcHsm2gTEE/OBBZVaMKb0QqNnJi6lWzVYK5P6qwpxFlWavvy7:ervy

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4892	2832	powershell.exe	102
PID 2832 wrote to memory of 4892	2832	powershell.exe	102

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
1⤵
PID:736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\print.exe
  "C:\Windows\system32\print.exe" h9
  2⤵
  PID:4892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zfgco1hj.p11.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2832-16-0x000001EC26440000-0x000001EC264B6000-memory.dmp

Filesize
472KB

Download
memory/2832-12-0x000001EC0D5A0000-0x000001EC0D5C2000-memory.dmp

Filesize
136KB

Download
memory/2832-13-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-14-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-15-0x000001EC25750000-0x000001EC25794000-memory.dmp

Filesize
272KB

Download
memory/2832-2-0x00007FFD3C233000-0x00007FFD3C235000-memory.dmp

Filesize
8KB

Download
memory/2832-18-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-19-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-20-0x00007FFD3C233000-0x00007FFD3C235000-memory.dmp

Filesize
8KB

Download
memory/2832-21-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-23-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-26-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-27-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-31-0x00007FFD3C230000-0x00007FFD3CCF1000-memory.dmp

Filesize
10.8MB

Download