Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 09:01
General
-
Target
721e44289afb034e90a67fb97eb5efd4d469bc95ba9863f16aed5e5909c76c61.ps1
-
Size
42KB
-
MD5
2bd198d265d67c9f4021eca5bb341900
-
SHA1
e3559a0d69e988877ce69d66b69cb41619521272
-
SHA256
721e44289afb034e90a67fb97eb5efd4d469bc95ba9863f16aed5e5909c76c61
-
SHA512
fa00e4b59b41ccbe865d342815001262323db96f99ebd30b1a5728111f9959c2e2775a5f279652649505ad23afe7a5551a705c650b985829cd2690f92f50e8f4
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\721e44289afb034e90a67fb97eb5efd4d469bc95ba9863f16aed5e5909c76c61.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1292-54-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmpFilesize
8KB
-
memory/1292-56-0x000007FEF55AE000-0x000007FEF55AF000-memory.dmpFilesize
4KB
-
memory/1292-57-0x00000000023C0000-0x00000000023C2000-memory.dmpFilesize
8KB
-
memory/1292-58-0x00000000023C2000-0x00000000023C4000-memory.dmpFilesize
8KB
-
memory/1292-59-0x00000000023C4000-0x00000000023C7000-memory.dmpFilesize
12KB
-
memory/1292-55-0x000007FEF2E80000-0x000007FEF39DD000-memory.dmpFilesize
11.4MB
-
memory/1292-60-0x000000001B7B0000-0x000000001BAAF000-memory.dmpFilesize
3.0MB
-
memory/1292-61-0x00000000023CB000-0x00000000023EA000-memory.dmpFilesize
124KB