ffce722622ee57ac7eeb2e3a768494db6a51d2a28ae447899301590cd936effb | Triage

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
18-05-2022 18:58

Sharing

Report Analysis Logs

General

Target

9d52abc5896a099f63fd8d2935d30d211cb6a3f5ed8e0d907bc0429cb8708d90.ps1
Size

16KB
MD5

822e50d817bbb212c9a5e16a782bc7c4
SHA1

251ed133c649fcbe288f105d5e66ca42244bb4f2
SHA256

9d52abc5896a099f63fd8d2935d30d211cb6a3f5ed8e0d907bc0429cb8708d90
SHA512

1218b00f32dae96e143436b0ff141767adce7ee710678f72d72a3e8a462c6b6a9cd477f50775d699e1c1adc613c326a44e32e5a25234037684e34128b1473b67

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1464 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1464 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\9d52abc5896a099f63fd8d2935d30d211cb6a3f5ed8e0d907bc0429cb8708d90.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-54-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Filesize
8KB

Download
memory/1464-55-0x000007FEF3720000-0x000007FEF427D000-memory.dmp

Filesize
11.4MB

Download
memory/1464-56-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1464-57-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download