Analysis
-
max time kernel
39s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:48
Static task
static1
Behavioral task
behavioral1
Sample
f0059614efab44e757aa98059faad7c7d7aad44bc509256c354981e27fdbd460.ps1
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f0059614efab44e757aa98059faad7c7d7aad44bc509256c354981e27fdbd460.ps1
Resource
win10v2004-20220812-en
General
-
Target
f0059614efab44e757aa98059faad7c7d7aad44bc509256c354981e27fdbd460.ps1
-
Size
25KB
-
MD5
edc305f647404882d1a589d06772b6a8
-
SHA1
6f4d961b5cecaeb7469fbbd4014bfd7c4e320408
-
SHA256
f0059614efab44e757aa98059faad7c7d7aad44bc509256c354981e27fdbd460
-
SHA512
45865b29e94befd5aa5a048ca66c47d4e37add842d8d6655b53f819dd956c96110a6605237627a92fb99a007f5a8f32526ee5835c0b7275a0980f15f241e3d21
-
SSDEEP
192:UKKmmCdlKv1vPsa35p0C1iympNf3CTo3d/7VdGQUhUVs9g7/f8ck:iklKvlsud1Qf3CToNo9k+
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1028 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1028 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\f0059614efab44e757aa98059faad7c7d7aad44bc509256c354981e27fdbd460.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1028-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/1028-55-0x000007FEF3C50000-0x000007FEF4673000-memory.dmpFilesize
10.1MB
-
memory/1028-56-0x000007FEF30F0000-0x000007FEF3C4D000-memory.dmpFilesize
11.4MB
-
memory/1028-57-0x0000000002A34000-0x0000000002A37000-memory.dmpFilesize
12KB
-
memory/1028-58-0x000000001B820000-0x000000001BB1F000-memory.dmpFilesize
3.0MB
-
memory/1028-59-0x0000000002A34000-0x0000000002A37000-memory.dmpFilesize
12KB
-
memory/1028-60-0x0000000002A3B000-0x0000000002A5A000-memory.dmpFilesize
124KB