Analysis
-
max time kernel
5s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-11-2020 03:41
Static task
static1
Behavioral task
behavioral1
Sample
cleartemp.ps1
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cleartemp.ps1
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
cleartemp.ps1
-
Size
146KB
-
MD5
d37fc91fc835071a3438abe832fe8583
-
SHA1
f48e6bf381bbbaf9dccfd5803435aee862a64d45
-
SHA256
0b07889a65e837600a28ae2df7c2fe6aa5a5cb93440e013139d7c0829a603599
-
SHA512
411a42662eb54e9506e98d6e5e695aec58efbc2186f34764859f21824945659d20b82240836d6f36143448fd606a0aff69d1d2263189f9892b42c728d385f39b
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1700 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1700-0-0x000007FEF58B0000-0x000007FEF629C000-memory.dmpFilesize
9.9MB
-
memory/1700-1-0x00000000023B0000-0x00000000023B1000-memory.dmpFilesize
4KB
-
memory/1700-2-0x000000001AA80000-0x000000001AA81000-memory.dmpFilesize
4KB
-
memory/1700-3-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/1700-4-0x0000000001DD0000-0x0000000001DD1000-memory.dmpFilesize
4KB
-
memory/1700-5-0x000000001B8D0000-0x000000001B8D1000-memory.dmpFilesize
4KB