Analysis
-
max time kernel
89s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
31-05-2022 03:11
General
-
Target
Loki 1.8/Panel/inc/class/misc.class.ps1
-
Size
66KB
-
MD5
619cd2ce2df8764750e66b4989c55ba8
-
SHA1
26ebf1af647c6a28f70b73e0263fd10da861b6f2
-
SHA256
b7d5548cbe65f4a3533708ad64309a4466022a9ce592bcf4cb42bd7d6dfe4c8e
-
SHA512
2e323b7a930065da53e19eb32911533733a3085700f5c3ec47448abc6e53f19f988d258c5ed8cf70d71eb7d3f795ceb4e8629cd635a2a3e07a9abaf5f3b93aac
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Loki 1.8\Panel\inc\class\misc.class.ps1"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3536-130-0x000001AC2ECC0000-0x000001AC2ECE2000-memory.dmpFilesize
136KB
-
memory/3536-131-0x00007FF96B0F0000-0x00007FF96BBB1000-memory.dmpFilesize
10.8MB
-
memory/3536-132-0x00007FF96B0F0000-0x00007FF96BBB1000-memory.dmpFilesize
10.8MB