Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 04:55
General
-
Target
Unlimited.ps1
-
Size
241KB
-
MD5
e9dd6ae79fddbcabe2aa76e8fddd0244
-
SHA1
7ba6c74d36634c6b673ecd05d69a22038e171c6f
-
SHA256
5227ed40f5ee2c8d976365582e7550bf43e1cedaca4ffdbf3f6993d78826ac47
-
SHA512
bbffbc363bbd1b97a21b8651f39998de6e7c9c8212e0a8c8ef4e9990b1af18a9b78e835bc2b41f87c5993e82e407d44f09009a6f6cb634d8dec06c9fa0b46244
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Unlimited.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-54-0x000007FEFB671000-0x000007FEFB673000-memory.dmpFilesize
8KB
-
memory/1808-55-0x000007FEF3310000-0x000007FEF3D33000-memory.dmpFilesize
10.1MB
-
memory/1808-56-0x000007FEF27B0000-0x000007FEF330D000-memory.dmpFilesize
11.4MB
-
memory/1808-57-0x0000000002A24000-0x0000000002A27000-memory.dmpFilesize
12KB
-
memory/1808-58-0x000000001B890000-0x000000001BB8F000-memory.dmpFilesize
3.0MB
-
memory/1808-59-0x0000000002A24000-0x0000000002A27000-memory.dmpFilesize
12KB
-
memory/1808-60-0x0000000002A2B000-0x0000000002A4A000-memory.dmpFilesize
124KB