Resubmissions

02-06-2022 22:15

220602-16kn1abhf3 10

02-06-2022 21:45

220602-1mh13abha3 7

02-06-2022 21:44

220602-1ln6pabgh8 8

02-06-2022 21:40

220602-1jcpwabgh5 10

02-06-2022 21:27

220602-1ay7hsffap 10

Analysis

  • max time kernel
    44s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    02-06-2022 21:40

General

  • Target

    1728.ps1

  • Size

    150KB

  • MD5

    732ac4665887f90ad5d320f0e462fce8

  • SHA1

    31cb6f21e3d2f50713163163d665053f83bb5bb4

  • SHA256

    3efec0b370dfacba1d8a2c9e8563441c6da54ae03925f3f845284d4ea9750731

  • SHA512

    8ec4408765d152108981b68a76c42a352f9c623d74220bbbce392500cb8e618a0bd4ac6e2f05057f8520d195d64c38a834facf5cfcf168546b68e4b0287dd849

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1728.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1336-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

    Filesize

    8KB

  • memory/1336-55-0x000007FEF28F0000-0x000007FEF3313000-memory.dmp

    Filesize

    10.1MB

  • memory/1336-56-0x000007FEF1D90000-0x000007FEF28ED000-memory.dmp

    Filesize

    11.4MB

  • memory/1336-57-0x000007FEF3320000-0x000007FEF41FC000-memory.dmp

    Filesize

    14.9MB

  • memory/1336-58-0x000007FEF28F0000-0x000007FEF3313000-memory.dmp

    Filesize

    10.1MB

  • memory/1336-59-0x000007FEFA890000-0x000007FEFA942000-memory.dmp

    Filesize

    712KB

  • memory/1336-60-0x0000000002984000-0x0000000002987000-memory.dmp

    Filesize

    12KB

  • memory/1336-61-0x000007FEF1D90000-0x000007FEF28ED000-memory.dmp

    Filesize

    11.4MB

  • memory/1336-62-0x000007FEFA820000-0x000007FEFA889000-memory.dmp

    Filesize

    420KB

  • memory/1336-63-0x000007FEFAA80000-0x000007FEFAAB2000-memory.dmp

    Filesize

    200KB

  • memory/1336-64-0x000007FEF6430000-0x000007FEF64DA000-memory.dmp

    Filesize

    680KB

  • memory/1336-65-0x000007FEF6340000-0x000007FEF6425000-memory.dmp

    Filesize

    916KB

  • memory/1336-66-0x000007FEF5FE0000-0x000007FEF61F6000-memory.dmp

    Filesize

    2.1MB

  • memory/1336-67-0x000007FEF5DC0000-0x000007FEF5ED8000-memory.dmp

    Filesize

    1.1MB

  • memory/1336-68-0x000007FEF5FA0000-0x000007FEF5FDE000-memory.dmp

    Filesize

    248KB

  • memory/1336-69-0x000007FEF4E90000-0x000007FEF5535000-memory.dmp

    Filesize

    6.6MB

  • memory/1336-70-0x000007FEF5710000-0x000007FEF587C000-memory.dmp

    Filesize

    1.4MB

  • memory/1336-71-0x000007FEF4CF0000-0x000007FEF4E85000-memory.dmp

    Filesize

    1.6MB

  • memory/1336-72-0x000007FEF5880000-0x000007FEF5BAE000-memory.dmp

    Filesize

    3.2MB

  • memory/1336-73-0x000007FEEEB60000-0x000007FEEF3AB000-memory.dmp

    Filesize

    8.3MB

  • memory/1336-74-0x000000000298B000-0x00000000029AA000-memory.dmp

    Filesize

    124KB

  • memory/1336-75-0x000007FEF3320000-0x000007FEF41FC000-memory.dmp

    Filesize

    14.9MB

  • memory/1336-76-0x000007FEF5FE0000-0x000007FEF61F6000-memory.dmp

    Filesize

    2.1MB

  • memory/1336-77-0x000007FEF5DC0000-0x000007FEF5ED8000-memory.dmp

    Filesize

    1.1MB

  • memory/1336-78-0x000007FEF28F0000-0x000007FEF3313000-memory.dmp

    Filesize

    10.1MB

  • memory/1336-79-0x000007FEFA890000-0x000007FEFA942000-memory.dmp

    Filesize

    712KB

  • memory/1336-80-0x0000000002984000-0x0000000002987000-memory.dmp

    Filesize

    12KB

  • memory/1336-81-0x000007FEF1D90000-0x000007FEF28ED000-memory.dmp

    Filesize

    11.4MB