5a6b3d721e7a2d977e98f217c1de129608515b310560eb28968b0330aaafe45d

Analysis

Target

f774d791-8b89-4228-932c-3b82c2e6c3d7.ps1
Size

849KB
MD5

361c2421e80a2cc8f6bbbb9eb114b323
SHA1

868d94a521a5d819a473b7b61bbeb89f52f20440
SHA256

5a6b3d721e7a2d977e98f217c1de129608515b310560eb28968b0330aaafe45d
SHA512

4bff143ced5683214db88476e3050703d64f86d4fefa312f648f4b6e285f598037da68f39c2aec23c5a3c6ff7c093964e6802a600373d3818bf6b742ab2d0719

Score

8^/10

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exe

flow pid process

9 1424 powershell.exe
35 1424 powershell.exe
44 1424 powershell.exe
49 1424 powershell.exe
51 1424 powershell.exe
52 1424 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1424 powershell.exe
1424 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1424 powershell.exe

pid	process
1424	powershell.exe
1424	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1424	powershell.exe

memory/1424-130-0x000002069C550000-0x000002069C572000-memory.dmp

Filesize
136KB

Download
memory/1424-131-0x00007FFB00220000-0x00007FFB00CE1000-memory.dmp

Filesize
10.8MB

Download
memory/1424-132-0x00007FFB00220000-0x00007FFB00CE1000-memory.dmp

Filesize
10.8MB

Download
memory/1424-133-0x000002069D770000-0x000002069D7B0000-memory.dmp

Filesize
256KB

Download
memory/1424-134-0x000002069D770000-0x000002069D7B0000-memory.dmp

Filesize
256KB

Download