Analysis

  • max time kernel
    116s
  • max time network
    119s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    22-09-2021 02:50

General

  • Target

    file.ps1

  • Size

    133KB

  • MD5

    d1da13b36a8ae1ff9bbfb351a7684fb4

  • SHA1

    cfa975bdb93561439ab52527d5041111c1351653

  • SHA256

    23d596e8c826aa53a88baec225080b6f7d298568f2302b4b419ae57f4724914b

  • SHA512

    afa85364c76b168da16b50d74bb14c8f0bf4a77ce4dd1ac6a1462851b5e97342cf435a11ac4fae1283284d7035e554618db0d682376cf7aa87582c499e1c77b9

Score
1/10

Malware Config

Signatures

  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps1
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2348-119-0x000001FCFE990000-0x000001FCFE991000-memory.dmp

    Filesize

    4KB

  • memory/2348-122-0x000001FCFEB40000-0x000001FCFEB41000-memory.dmp

    Filesize

    4KB

  • memory/2348-123-0x000001FCFE950000-0x000001FCFE952000-memory.dmp

    Filesize

    8KB

  • memory/2348-124-0x000001FCFE953000-0x000001FCFE955000-memory.dmp

    Filesize

    8KB

  • memory/2348-133-0x000001FCFE956000-0x000001FCFE958000-memory.dmp

    Filesize

    8KB

  • memory/2348-135-0x000001FCFE958000-0x000001FCFE95A000-memory.dmp

    Filesize

    8KB

  • memory/2348-149-0x000001FCFE95A000-0x000001FCFE95F000-memory.dmp

    Filesize

    20KB