Analysis
-
max time kernel
14s -
max time network
40s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-08-2021 05:57
General
-
Target
dhl/dhl/core/autoload.php.ps1
-
Size
845B
-
MD5
90abcbe5f03aa3972e2530ff8cdd3c8b
-
SHA1
1a7490ed038eeb594e0c9fe70f28762d4cd096f0
-
SHA256
9b017150d9bf12b38a6d0c5d6ad5c1a7bf79a73726f192397dd652dda6a7f475
-
SHA512
f238ea9618b254612fe9f29bc98b5b6abea311f3779a43a11910e937a5d7a41486ffbb8eb4d4a77e0453160593bf5cc56c238ef6815b4d463cf35c3f58c69416
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\dhl\dhl\core\autoload.php.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-60-0x000007FEFBB31000-0x000007FEFBB33000-memory.dmpFilesize
8KB
-
memory/664-61-0x0000000002400000-0x0000000002401000-memory.dmpFilesize
4KB
-
memory/664-62-0x000000001AA30000-0x000000001AA31000-memory.dmpFilesize
4KB
-
memory/664-63-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/664-64-0x0000000002380000-0x0000000002382000-memory.dmpFilesize
8KB
-
memory/664-65-0x0000000002384000-0x0000000002386000-memory.dmpFilesize
8KB
-
memory/664-66-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB