Analysis

  • max time kernel
    44s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    03-06-2022 04:28

General

  • Target

    1728.ps1

  • Size

    150KB

  • MD5

    732ac4665887f90ad5d320f0e462fce8

  • SHA1

    31cb6f21e3d2f50713163163d665053f83bb5bb4

  • SHA256

    3efec0b370dfacba1d8a2c9e8563441c6da54ae03925f3f845284d4ea9750731

  • SHA512

    8ec4408765d152108981b68a76c42a352f9c623d74220bbbce392500cb8e618a0bd4ac6e2f05057f8520d195d64c38a834facf5cfcf168546b68e4b0287dd849

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1728.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1888-54-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

    Filesize

    8KB

  • memory/1888-55-0x000007FEF3F60000-0x000007FEF4983000-memory.dmp

    Filesize

    10.1MB

  • memory/1888-56-0x000007FEF3400000-0x000007FEF3F5D000-memory.dmp

    Filesize

    11.4MB

  • memory/1888-57-0x000007FEF4990000-0x000007FEF586C000-memory.dmp

    Filesize

    14.9MB

  • memory/1888-58-0x000007FEF3F60000-0x000007FEF4983000-memory.dmp

    Filesize

    10.1MB

  • memory/1888-59-0x000007FEF65A0000-0x000007FEF6652000-memory.dmp

    Filesize

    712KB

  • memory/1888-60-0x0000000002844000-0x0000000002847000-memory.dmp

    Filesize

    12KB

  • memory/1888-61-0x000007FEF3400000-0x000007FEF3F5D000-memory.dmp

    Filesize

    11.4MB

  • memory/1888-62-0x000007FEFA4F0000-0x000007FEFA559000-memory.dmp

    Filesize

    420KB

  • memory/1888-63-0x000007FEF67F0000-0x000007FEF6822000-memory.dmp

    Filesize

    200KB

  • memory/1888-64-0x000007FEF64F0000-0x000007FEF659A000-memory.dmp

    Filesize

    680KB

  • memory/1888-65-0x000007FEF6400000-0x000007FEF64E5000-memory.dmp

    Filesize

    916KB

  • memory/1888-66-0x000007FEF2EB0000-0x000007FEF30C6000-memory.dmp

    Filesize

    2.1MB

  • memory/1888-67-0x000007FEF2D90000-0x000007FEF2EA8000-memory.dmp

    Filesize

    1.1MB

  • memory/1888-68-0x000007FEF67B0000-0x000007FEF67EE000-memory.dmp

    Filesize

    248KB

  • memory/1888-69-0x000007FEF2550000-0x000007FEF2BF5000-memory.dmp

    Filesize

    6.6MB

  • memory/1888-70-0x000007FEF23E0000-0x000007FEF254C000-memory.dmp

    Filesize

    1.4MB

  • memory/1888-72-0x000000000284B000-0x000000000286A000-memory.dmp

    Filesize

    124KB

  • memory/1888-71-0x000007FEF2240000-0x000007FEF23D5000-memory.dmp

    Filesize

    1.6MB

  • memory/1888-73-0x000007FEF30D0000-0x000007FEF33FE000-memory.dmp

    Filesize

    3.2MB

  • memory/1888-74-0x000007FEF19F0000-0x000007FEF223B000-memory.dmp

    Filesize

    8.3MB

  • memory/1888-75-0x000007FEF4990000-0x000007FEF586C000-memory.dmp

    Filesize

    14.9MB

  • memory/1888-76-0x000007FEF3F60000-0x000007FEF4983000-memory.dmp

    Filesize

    10.1MB

  • memory/1888-77-0x000007FEF65A0000-0x000007FEF6652000-memory.dmp

    Filesize

    712KB

  • memory/1888-78-0x0000000002844000-0x0000000002847000-memory.dmp

    Filesize

    12KB

  • memory/1888-79-0x000007FEF3400000-0x000007FEF3F5D000-memory.dmp

    Filesize

    11.4MB

  • memory/1888-80-0x000007FEF2EB0000-0x000007FEF30C6000-memory.dmp

    Filesize

    2.1MB