Overview

overview

10

Static

static

srv.ps1

windows7_x64

1

srv.ps1

windows10-2004_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    19-01-2022 15:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    srv.ps1

  • Size

    3.6MB

  • MD5

    bdfc70e3237617d7a4509e9a857234eb

  • SHA1

    7b1e093f630ded929fefe02c554d09a1a9d13c54

  • SHA256

    d96de808e92e4d42e93180be95ec52fbe490c506cd839365e71cb7168df6bfbd

  • SHA512

    5bdde5d55b60e7ba1fb448bf95dd45feb2936ebaf53f5a78fa8272b522836d21a884ec5db523d09605f565d382e0015ee055de1976a3093defcc162d43abd857

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\srv.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1720-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1720-55-0x000007FEF29D0000-0x000007FEF352D000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/1720-56-0x00000000028D0000-0x00000000028D2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1720-57-0x00000000028D2000-0x00000000028D4000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1720-58-0x00000000028D4000-0x00000000028D7000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1720-59-0x000000001B770000-0x000000001BA6F000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/1720-60-0x00000000028DB000-0x00000000028FA000-memory.dmp
    Filesize

    124KB

    Download