d1567088ef227fa65659956d6a71f5af4c17ce52097b9b63074f3a21a6f61d71 | Triage

Analysis

max time kernel
31s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 23:55

Sharing

Report Analysis Logs

General

Target

7.32̨ֻģ/admin/postcheck.ps1
Size

3KB
MD5

91e70171a377eb9cc55817fe4acc37aa
SHA1

6219608370d7fb1a4f49622fe36252c30bd3ad1d
SHA256

157a53a16dc89e1183123bd8ccc1e54e77e7d71d78a6e4c0bdb00625b35c651d
SHA512

bf9ee095ce6e69c0d0cf16e1f2ad47c598e3c6751608d4ac23546494cbfa990112f31f67acc9243f92bf4e10aa0ff625bb95aeed89bf45d7261df8ab377fedda

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2208 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2208 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\7.32̨ֻģ\admin\postcheck.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-132-0x000002B5BFF70000-0x000002B5BFF92000-memory.dmp

Filesize
136KB

Download
memory/2208-133-0x00007FFDF4B90000-0x00007FFDF5651000-memory.dmp

Filesize
10.8MB

Download
memory/2208-134-0x00007FFDF4B90000-0x00007FFDF5651000-memory.dmp

Filesize
10.8MB

Download