d85f98d099a72c2b51b142e63916264f2a7051aeff04959214d91e69fcc1e590 | Triage

Resubmissions

07-06-2022 07:35

220607-jesrvscba4 10

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-06-2022 07:35

Sharing

Report Analysis Logs

General

Target

download.ps1
Size

3KB
MD5

4f5f72a11fea6e60743efe1fc5259b93
SHA1

c5e4b99e87841bf74531ba3df2d4150384098b80
SHA256

d85f98d099a72c2b51b142e63916264f2a7051aeff04959214d91e69fcc1e590
SHA512

5c3f5c58fdc63a0d3672a402413e549a7af4c730bfec0847efd2043797d429d825338f6503436dacdfd077484f0dbcdc0a1691f4bf23c3740a6d8eec51bafd77

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4344 powershell.exe
4344 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4344 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\download.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-130-0x000001A4A2FB0000-0x000001A4A2FD2000-memory.dmp

Filesize
136KB

Download
memory/4344-131-0x00007FF8D7140000-0x00007FF8D7C01000-memory.dmp

Filesize
10.8MB

Download
memory/4344-132-0x00007FF8D7140000-0x00007FF8D7C01000-memory.dmp

Filesize
10.8MB

Download