Analysis

  • max time kernel
    64s
  • max time network
    93s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    30-08-2021 05:33

General

  • Target

    masam/assets/images/banner/slider-3.jpg.ps1

  • Size

    305KB

  • MD5

    d4641d37d52119ebd3055b1d61fc44da

  • SHA1

    a30508de242c0805d3114c7e5430d9a1ddec622c

  • SHA256

    55308ec5b07983fe0c5eecc4ae58066e9b5575a53c1d38587bb29b64851c6231

  • SHA512

    d2c6858462cd3a410b41e1b57ab47d1cc7dcfc4a1c108ad95b7820156ab52fe8d92fc32973311bd8981e3f5c7dec16c05862269fa6f0166807e58f37e0d86e5d

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\masam\assets\images\banner\slider-3.jpg.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1036-60-0x000007FEFB701000-0x000007FEFB703000-memory.dmp

    Filesize

    8KB

  • memory/1036-61-0x00000000022E0000-0x00000000022E1000-memory.dmp

    Filesize

    4KB

  • memory/1036-62-0x000000001AA90000-0x000000001AA91000-memory.dmp

    Filesize

    4KB

  • memory/1036-63-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/1036-65-0x000000001AA14000-0x000000001AA16000-memory.dmp

    Filesize

    8KB

  • memory/1036-64-0x000000001AA10000-0x000000001AA12000-memory.dmp

    Filesize

    8KB

  • memory/1036-66-0x00000000025E0000-0x00000000025E1000-memory.dmp

    Filesize

    4KB