Overview

overview

1

Static

static

sitepress-...es.ps1

windows7_x64

1

sitepress-...es.ps1

windows10-2004_x64

1

sitepress-...ion.js

windows7_x64

1

sitepress-...ion.js

windows10-2004_x64

1

sitepress-...er.ps1

windows7_x64

1

sitepress-...er.ps1

windows10-2004_x64

1

sitepress-...ot.ps1

windows7_x64

1

sitepress-...ot.ps1

windows10-2004_x64

1

sitepress-...als.js

windows7_x64

1

sitepress-...als.js

windows10-2004_x64

1

sitepress-...te.ps1

windows7_x64

1

sitepress-...te.ps1

windows10-2004_x64

1

sitepress-...tly.js

windows7_x64

1

sitepress-...tly.js

windows10-2004_x64

1

sitepress-...on.ps1

windows7_x64

1

sitepress-...on.ps1

windows10-2004_x64

1

sitepress-...es.ps1

windows7_x64

1

sitepress-...es.ps1

windows10-2004_x64

1

sitepress-...on.ps1

windows7_x64

1

sitepress-...on.ps1

windows10-2004_x64

1

sitepress-...ds.ps1

windows7_x64

1

sitepress-...ds.ps1

windows10-2004_x64

1

sitepress-...es.ps1

windows7_x64

1

sitepress-...es.ps1

windows10-2004_x64

1

sitepress-...ion.js

windows7_x64

1

sitepress-...ion.js

windows10-2004_x64

1

sitepress-...age.js

windows7_x64

1

sitepress-...age.js

windows10-2004_x64

1

sitepress-...ion.js

windows7_x64

1

sitepress-...ion.js

windows10-2004_x64

1

sitepress-...tup.js

windows7_x64

1

sitepress-...tup.js

windows10-2004_x64

1

Analysis

  • max time kernel
    39s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 19:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sitepress-multilingual-cms/class.plugin-modules.ps1

  • Size

    33KB

  • MD5

    b2e98238fabfe4160c3bb613b2303a89

  • SHA1

    3f45ae4b554214c390ece0d1609516325538bffe

  • SHA256

    27995818a8fb4463deb9c9ac0a69180a8d31f4a6286781e84926508ad2191233

  • SHA512

    fc5fef904c77df442347a475a66202afdf48ba99ced6c9fae6c60f23bc66a67bab83e6b0ebd20503bd10ca2166303e1e92e72d4303a9d9802fed84a4828e1f4d

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sitepress-multilingual-cms\class.plugin-modules.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/908-54-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmp
    Filesize

    8KB

    Download
  • memory/908-56-0x000007FEF3E70000-0x000007FEF49CD000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/908-57-0x00000000028B4000-0x00000000028B7000-memory.dmp
    Filesize

    12KB

    Download
  • memory/908-58-0x00000000028BB000-0x00000000028DA000-memory.dmp
    Filesize

    124KB

    Download