b1313253704746db20556908eea196d8f909f7332a3ff934c57e7385facc2a9a

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
02-06-2022 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1313253704746db20556908eea196d8f909f7332a3ff934c57e7385facc2a9a.ps1
Size

30KB
MD5

9c0e668b4ffffb0b2b9348cc0fd100d7
SHA1

6b1f8046633b3d4bca139d5601005a1a7b01aa99
SHA256

b1313253704746db20556908eea196d8f909f7332a3ff934c57e7385facc2a9a
SHA512

c3cfec27f0afd66ffa196679a2d5edd55b81c74dc854f707df188a00f9c8dce31df67843119f957c7788a099708f51c915e918a47ac567b3fc24d5da1d33b14b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1580 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1580 powershell.exe

pid	process
1580	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1580	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b1313253704746db20556908eea196d8f909f7332a3ff934c57e7385facc2a9a.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-54-0x000007FEFBF01000-0x000007FEFBF03000-memory.dmp

Filesize
8KB

Download
memory/1580-55-0x000007FEF3BA0000-0x000007FEF45C3000-memory.dmp

Filesize
10.1MB

Download
memory/1580-56-0x000007FEF3040000-0x000007FEF3B9D000-memory.dmp

Filesize
11.4MB

Download
memory/1580-57-0x000007FEF45D0000-0x000007FEF54AC000-memory.dmp

Filesize
14.9MB

Download
memory/1580-58-0x000007FEF3BA0000-0x000007FEF45C3000-memory.dmp

Filesize
10.1MB

Download
memory/1580-59-0x000007FEFB1F0000-0x000007FEFB2A2000-memory.dmp

Filesize
712KB

Download
memory/1580-60-0x00000000024E4000-0x00000000024E7000-memory.dmp

Filesize
12KB

Download
memory/1580-61-0x000007FEF3040000-0x000007FEF3B9D000-memory.dmp

Filesize
11.4MB

Download
memory/1580-63-0x000007FEFB140000-0x000007FEFB172000-memory.dmp

Filesize
200KB

Download
memory/1580-62-0x000007FEFB180000-0x000007FEFB1E9000-memory.dmp

Filesize
420KB

Download
memory/1580-64-0x000007FEF6D60000-0x000007FEF6E0A000-memory.dmp

Filesize
680KB

Download
memory/1580-65-0x000007FEF64C0000-0x000007FEF67EE000-memory.dmp

Filesize
3.2MB

Download
memory/1580-67-0x000007FEF6C70000-0x000007FEF6D55000-memory.dmp

Filesize
916KB

Download
memory/1580-66-0x000007FEF3040000-0x000007FEF3B9D000-memory.dmp

Filesize
11.4MB

Download
memory/1580-69-0x000007FEF6910000-0x000007FEF6B26000-memory.dmp

Filesize
2.1MB

Download
memory/1580-68-0x000007FEF3BA0000-0x000007FEF45C3000-memory.dmp

Filesize
10.1MB

Download
memory/1580-70-0x000007FEFB1F0000-0x000007FEFB2A2000-memory.dmp

Filesize
712KB

Download
memory/1580-71-0x000007FEF63A0000-0x000007FEF64B8000-memory.dmp

Filesize
1.1MB

Download
memory/1580-72-0x000007FEF68D0000-0x000007FEF690E000-memory.dmp

Filesize
248KB

Download
memory/1580-73-0x000007FEF60A0000-0x000007FEF620C000-memory.dmp

Filesize
1.4MB

Download
memory/1580-74-0x000007FEF5F00000-0x000007FEF6095000-memory.dmp

Filesize
1.6MB

Download
memory/1580-75-0x000007FEEF580000-0x000007FEEFC25000-memory.dmp

Filesize
6.6MB

Download
memory/1580-76-0x00000000024EB000-0x000000000250A000-memory.dmp

Filesize
124KB

Download
memory/1580-77-0x000007FEF27F0000-0x000007FEF303B000-memory.dmp

Filesize
8.3MB

Download
memory/1580-78-0x000007FEF45D0000-0x000007FEF54AC000-memory.dmp

Filesize
14.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads