Analysis
-
max time kernel
54s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
-
submitted
16-07-2022 10:03
General
-
Target
cobalt2.ps1
-
Size
3KB
-
MD5
5816bf8947b292fd5837d340fae832d0
-
SHA1
030b8d8abf08be5d099d8a522d3011963fd84246
-
SHA256
b9dc6cb759631733b4911dff24e61a73d56e47e01d218c7f219b2811cb93e249
-
SHA512
3968e37b2156ffa1f02681d117719670084bf1444dd09e65d2da62ae8740b1c3d040cbbf0c05c6596e281d564ebb0d392e64b644482ef49764abd7b85fd87370
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cobalt2.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
104KB
-
Filesize
6.5MB
-
-
Filesize
216KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
10.8MB