Analysis

  • max time kernel
    39s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2022, 15:27

General

  • Target

    wp-all-import-pro/classes/PHPExcel/CachedObjectStorage/CacheBase.ps1

  • Size

    10KB

  • MD5

    dd224d6315624b8b91da15d1f18027db

  • SHA1

    d7cbc4a162ed75ba4b491bc5c8e47a1c3a9e434d

  • SHA256

    fae3956a5a3622d119190f4f7395557616e2ad1a52a530c0e3ebd01fae4c92e9

  • SHA512

    0c12b88ff464a90730f62ea8d0c13a31b73e5624fd38545e0f696e71e464a2c1953683885dc5efa3e49acdb42b677e189e34603fabed4a0a4ce89a48df92f485

  • SSDEEP

    192:/NuSHTkuklNN3NNUuHDwk9N9qDfYTsY2RyZSXa33TckZZAJEVYTI3bdgcuy3+Iyw:VuSAH9SRqoo1VbJgn+

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wp-all-import-pro\classes\PHPExcel\CachedObjectStorage\CacheBase.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/840-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

    Filesize

    8KB

  • memory/840-55-0x000007FEF45A0000-0x000007FEF4FC3000-memory.dmp

    Filesize

    10.1MB

  • memory/840-56-0x000007FEF3A40000-0x000007FEF459D000-memory.dmp

    Filesize

    11.4MB

  • memory/840-57-0x0000000002744000-0x0000000002747000-memory.dmp

    Filesize

    12KB

  • memory/840-58-0x0000000002744000-0x0000000002747000-memory.dmp

    Filesize

    12KB

  • memory/840-59-0x000000000274B000-0x000000000276A000-memory.dmp

    Filesize

    124KB