Analysis
-
max time kernel
41s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
28-10-2022 23:55
General
-
Target
7.32ֻ̨ģ/admin/bakup.ps1
-
Size
5KB
-
MD5
eeef55864f4a7ad73941d91d1b74bc99
-
SHA1
03a32c174440360f07e84e9d7a8a647b52ccd053
-
SHA256
981492c24a80c21727db65b382bcabc5ef86e2d81133f561b688e900d1245693
-
SHA512
8a85c0bab88bc06f2d7cfd35e5ac6a9b0890d514accabeab0b6e842b067c20509de5b50accbcf51f0566e0dcd802e29c48c7ef1d6984916b4d8b110d74649ded
-
SSDEEP
96:Cv0WKxbzXUE83+LjViJf4KvZK9p0yBfzN5BdlBUMeP4yIGCctNEQT0VcOC5E4m0r:Cv0WKVKTJfDyBfpjBOwypTbm5SHqWzT1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\7.32ֻ̨ģ\admin\bakup.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
10.1MB
-
Filesize
12KB
-
Filesize
11.4MB
-
Filesize
12KB
-
Filesize
124KB