Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    30-07-2021 15:25

General

  • Target

    8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1

  • Size

    1KB

  • MD5

    c3bc357d17e8b2403ce323807e75911a

  • SHA1

    4b37b7afbadab1bbdac7e43fb283f7180e47ea1d

  • SHA256

    8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8

  • SHA512

    463b9dd8f7d8006ec0f28b9383357904b3caeeaf1792e1127be011b20f1ee0c49ca422c4ed7fbfed60fad83bfff5d6728da43e68b4863d6032b7866e162b9c86

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1676-60-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

    Filesize

    8KB

  • memory/1676-61-0x0000000002520000-0x0000000002521000-memory.dmp

    Filesize

    4KB

  • memory/1676-62-0x000000001AAE0000-0x000000001AAE1000-memory.dmp

    Filesize

    4KB

  • memory/1676-63-0x00000000026F0000-0x00000000026F1000-memory.dmp

    Filesize

    4KB

  • memory/1676-65-0x000000001AA64000-0x000000001AA66000-memory.dmp

    Filesize

    8KB

  • memory/1676-64-0x000000001AA60000-0x000000001AA62000-memory.dmp

    Filesize

    8KB

  • memory/1676-66-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB

  • memory/1676-67-0x000000001C2C0000-0x000000001C2C1000-memory.dmp

    Filesize

    4KB

  • memory/1676-68-0x000000001AA6A000-0x000000001AA89000-memory.dmp

    Filesize

    124KB