Analysis
-
max time kernel
35s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 16:52
Static task
static1
Behavioral task
behavioral1
Sample
red.ps1
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
red.ps1
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
red.ps1
-
Size
420KB
-
MD5
8deb78e7465c7aa01dce0f7b56afd75a
-
SHA1
46dfe591424f1c811c6da80b81ca3962e8667588
-
SHA256
1f531a7a7e0024d96701bd6c09c97cda0e56690deb7b53b9b855017000bf0baa
-
SHA512
c6a9d751ab704d5c7ea56f4b7377b2e6a81e4f1098b6765ece65685dab39289ead9f869bd6913b14b36e7379bc947c2392d42e6e2dc8020f098d63fb7588cda1
-
SSDEEP
6144:cRRIHFh8pCFAECNTT0vgPq+jscEI+ZVF10o+mjgQrsSJI5ELFTVoZphtyUfku2wy:cPCFST04y+0hVjbihU
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1668 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1668 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1668-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/1668-55-0x000007FEF3C50000-0x000007FEF4673000-memory.dmpFilesize
10.1MB
-
memory/1668-56-0x000007FEF30F0000-0x000007FEF3C4D000-memory.dmpFilesize
11.4MB
-
memory/1668-57-0x0000000002454000-0x0000000002457000-memory.dmpFilesize
12KB
-
memory/1668-58-0x000000000245B000-0x000000000247A000-memory.dmpFilesize
124KB
-
memory/1668-59-0x0000000002454000-0x0000000002457000-memory.dmpFilesize
12KB
-
memory/1668-60-0x000000000245B000-0x000000000247A000-memory.dmpFilesize
124KB