860cae2ca6d44d8d9a34df314e7b3f1a64116f2ebe6279ed160fc2f0d7ebea95

Analysis

Target

SYSWOW64.ps1
Size

3KB
MD5

0866c5b72df63add6f9884806682308a
SHA1

6b157db9a413b8e7d7c33b8b4a5713cdbf6f4dea
SHA256

860cae2ca6d44d8d9a34df314e7b3f1a64116f2ebe6279ed160fc2f0d7ebea95
SHA512

bc865a758fa7790e346a7ebb19cd3a3871f7aa16b88b80116bad0846d88104203f81bfd4bf73c46b1d770950c6ff0b48475e313277d51171c42227fe3128b82b

Score

7^/10

Drops startup file 1 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelGraphicsDriverUpdates.vbs	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1464 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1464 powershell.exe

pid	process
1464	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1464	powershell.exe

memory/1464-54-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Filesize
8KB

Download
memory/1464-55-0x000007FEF4280000-0x000007FEF4CA3000-memory.dmp

Filesize
10.1MB

Download
memory/1464-56-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/1464-57-0x000007FEF3720000-0x000007FEF427D000-memory.dmp

Filesize
11.4MB

Download
memory/1464-58-0x000000001B8B0000-0x000000001BBAF000-memory.dmp

Filesize
3.0MB

Download
memory/1464-59-0x000007FEEDB60000-0x000007FEEEBF6000-memory.dmp

Filesize
16.6MB

Download
memory/1464-60-0x000000000284B000-0x000000000286A000-memory.dmp

Filesize
124KB

Download
memory/1464-61-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/1464-62-0x000000000284B000-0x000000000286A000-memory.dmp

Filesize
124KB

Download