Overview

overview

1

Static

static

sitepress-...es.ps1

windows7_x64

1

sitepress-...es.ps1

windows10-2004_x64

1

sitepress-...ion.js

windows7_x64

1

sitepress-...ion.js

windows10-2004_x64

1

sitepress-...er.ps1

windows7_x64

1

sitepress-...er.ps1

windows10-2004_x64

1

sitepress-...ot.ps1

windows7_x64

1

sitepress-...ot.ps1

windows10-2004_x64

1

sitepress-...als.js

windows7_x64

1

sitepress-...als.js

windows10-2004_x64

1

sitepress-...te.ps1

windows7_x64

1

sitepress-...te.ps1

windows10-2004_x64

1

sitepress-...tly.js

windows7_x64

1

sitepress-...tly.js

windows10-2004_x64

1

sitepress-...on.ps1

windows7_x64

1

sitepress-...on.ps1

windows10-2004_x64

1

sitepress-...es.ps1

windows7_x64

1

sitepress-...es.ps1

windows10-2004_x64

1

sitepress-...on.ps1

windows7_x64

1

sitepress-...on.ps1

windows10-2004_x64

1

sitepress-...ds.ps1

windows7_x64

1

sitepress-...ds.ps1

windows10-2004_x64

1

sitepress-...es.ps1

windows7_x64

1

sitepress-...es.ps1

windows10-2004_x64

1

sitepress-...ion.js

windows7_x64

1

sitepress-...ion.js

windows10-2004_x64

1

sitepress-...age.js

windows7_x64

1

sitepress-...age.js

windows10-2004_x64

1

sitepress-...ion.js

windows7_x64

1

sitepress-...ion.js

windows10-2004_x64

1

sitepress-...tup.js

windows7_x64

1

sitepress-...tup.js

windows10-2004_x64

1

Analysis

  • max time kernel
    101s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 19:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sitepress-multilingual-cms/classes/action-filter-loader/class-wpml-action-filter-loader.ps1

  • Size

    3KB

  • MD5

    df9c2568d1946d3a2ae75047d80c09ae

  • SHA1

    380273055a2e4ff8b82e9e17ddaca4b41e303937

  • SHA256

    93f5a100f55e52e10f31dfa8a47105fa8e1db5e704dc99b5a89235ba7a0f8690

  • SHA512

    b17feb11c6c7ec4b9304213797a2e219fd114130ea9990af51964ce1ed2b23b8c1c5077e75b200085661607a776a0cd1914144e0c4090814ebcd8d3d8b2fd026

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sitepress-multilingual-cms\classes\action-filter-loader\class-wpml-action-filter-loader.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1744-130-0x0000022B5F8A0000-0x0000022B5F8C2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1744-131-0x00007FFC628A0000-0x00007FFC63361000-memory.dmp
    Filesize

    10.8MB

    Download