Overview

overview

10

Static

static

Document-1310.iso

windows7_x64

3

Document-1310.iso

windows10-2004_x64

3

1662.ps1

windows7_x64

1

1662.ps1

windows10-2004_x64

10

Scan_139.jpg

windows7_x64

3

Scan_139.jpg

windows10-2004_x64

3

Scan_139.jpg.lnk

windows7_x64

3

Scan_139.jpg.lnk

windows10-2004_x64

10

x.txt

windows7_x64

1

x.txt

windows10-2004_x64

1

Resubmissions

05-06-2022 15:10

220605-sj6zqabfd5 8

02-06-2022 19:49

220602-yjvvcabad9 10

Analysis

  • max time kernel
    41s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    02-06-2022 19:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1662.ps1

  • Size

    192KB

  • MD5

    3f5498ca9c0d3d185bc45edf45185d07

  • SHA1

    f945b742489e29dff58fd41a4f6293b6deb57533

  • SHA256

    caa1268740d0b48795621f8d0e127fd4574c87de5c16f5348fadc97866d1de39

  • SHA512

    34849f297613c9c2b284704e65701aa88ded0ccea1956d55233a052810149b81489c4e7b6bd0416b53d394ec676221527fbe700434756ed04827b5b9bad0334c

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1662.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/952-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp
    Filesize

    8KB

    Download
  • memory/952-55-0x000007FEF3800000-0x000007FEF4223000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/952-56-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/952-57-0x000007FEF4230000-0x000007FEF510C000-memory.dmp
    Filesize

    14.9MB

    Download
  • memory/952-58-0x000007FEF3800000-0x000007FEF4223000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/952-60-0x00000000024C4000-0x00000000024C7000-memory.dmp
    Filesize

    12KB

    Download
  • memory/952-59-0x000007FEF6880000-0x000007FEF6932000-memory.dmp
    Filesize

    712KB

    Download
  • memory/952-61-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/952-62-0x000007FEFAB90000-0x000007FEFABF9000-memory.dmp
    Filesize

    420KB

    Download
  • memory/952-63-0x000007FEFAEC0000-0x000007FEFAEF2000-memory.dmp
    Filesize

    200KB

    Download
  • memory/952-64-0x000007FEF66E0000-0x000007FEF678A000-memory.dmp
    Filesize

    680KB

    Download
  • memory/952-65-0x000007FEF65F0000-0x000007FEF66D5000-memory.dmp
    Filesize

    916KB

    Download
  • memory/952-66-0x000007FEF5F00000-0x000007FEF6116000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/952-68-0x000007FEFAE50000-0x000007FEFAE8E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/952-67-0x000007FEF64D0000-0x000007FEF65E8000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/952-69-0x000000001B700000-0x000000001B9FF000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/952-70-0x000007FEF25F0000-0x000007FEF2C95000-memory.dmp
    Filesize

    6.6MB

    Download
  • memory/952-71-0x000007FEF5C00000-0x000007FEF5D6C000-memory.dmp
    Filesize

    1.4MB

    Download
  • memory/952-72-0x000007FEF2450000-0x000007FEF25E5000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/952-73-0x00000000024CB000-0x00000000024EA000-memory.dmp
    Filesize

    124KB

    Download
  • memory/952-74-0x000007FEF6120000-0x000007FEF644E000-memory.dmp
    Filesize

    3.2MB

    Download
  • memory/952-75-0x000007FEEEA00000-0x000007FEEF24B000-memory.dmp
    Filesize

    8.3MB

    Download
  • memory/952-76-0x000007FEF4230000-0x000007FEF510C000-memory.dmp
    Filesize

    14.9MB

    Download
  • memory/952-77-0x000007FEF25F0000-0x000007FEF2C95000-memory.dmp
    Filesize

    6.6MB

    Download
  • memory/952-78-0x000007FEF3800000-0x000007FEF4223000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/952-79-0x000007FEF6880000-0x000007FEF6932000-memory.dmp
    Filesize

    712KB

    Download
  • memory/952-80-0x00000000024C4000-0x00000000024C7000-memory.dmp
    Filesize

    12KB

    Download
  • memory/952-81-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/952-82-0x000007FEF5F00000-0x000007FEF6116000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/952-83-0x000007FEF64D0000-0x000007FEF65E8000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/952-84-0x00000000024CB000-0x00000000024EA000-memory.dmp
    Filesize

    124KB

    Download