Analysis
-
max time kernel
23s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
06-10-2022 10:54
General
-
Target
wordfence/crypto/vendor/paragonie/sodium_compat/src/Core32/Curve25519/Fe.ps1
-
Size
5KB
-
MD5
4ee9560f6c7e1cf286136d5b25577404
-
SHA1
eee8979d82214f83ee0e661f4da8078adebdf974
-
SHA256
2a7d14c8eda6480e513b6ab6caba7c6f9605fd01042813a5b84b1d8be1934797
-
SHA512
8ab5a8bf1fcca779bfb042f36a727a649511d0eb2b74ead34d23e8242409ae407f09f53304c465c4500e2a87deffda5639141d93caa29deffda431546dd60df7
-
SSDEEP
96:t65S1PE16r8VgkBx5tUJtyuJmgk5seVOyu/XD2P4fSoEhyw4pp7oBGhTI163MJe+:E2E164WgDUTym1JeVOyiXD20TEsjTMB/
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wordfence\crypto\vendor\paragonie\sodium_compat\src\Core32\Curve25519\Fe.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
10.1MB
-
Filesize
12KB
-
Filesize
11.4MB
-
Filesize
3.0MB
-
Filesize
124KB
-
Filesize
12KB
-
Filesize
124KB