a6b3df0aa176236e3b7504d407400538d51f1449f11bbe75c81b265bc298d984 | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2022, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

file01.ps1
Size

108B
MD5

acfaea42a91501a4385600127e5cca07
SHA1

8f0fc117fc1ec00a1447be7b46626e732cb72687
SHA256

a6b3df0aa176236e3b7504d407400538d51f1449f11bbe75c81b265bc298d984
SHA512

dae5369e0f7bcda377eeca73db8d8b40eb9e1764a5ebacb1b54ff9fae213aead3d1ebb62a4f3d0d379b4b5701d62eed72467f7e8512f6bf79e9312ef674cec1e

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	2220	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	powershell.exe
2220	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-132-0x000001DC7F150000-0x000001DC7F172000-memory.dmp

Filesize
136KB

Download
memory/2220-133-0x00007FF857570000-0x00007FF858031000-memory.dmp

Filesize
10.8MB

Download
memory/2220-134-0x00007FF857570000-0x00007FF858031000-memory.dmp

Filesize
10.8MB

Download