Analysis
- max time kernel
37s - max time network
44s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
26/11/2022, 08:36
General
- Target Done.Ps1.ps1
- Size 424KB
- Sample221126-khk2vsfa28
- SHA256 beeb242bb1a4ffa7cc706ac482236afb457d52ffdb0defcde160528b858c6b03
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Done.Ps1.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2020-54-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp
memory/2020-55-0x000007FEF3410000-0x000007FEF3E33000-memory.dmp
memory/2020-57-0x00000000023A4000-0x00000000023A7000-memory.dmp
memory/2020-56-0x000007FEF28B0000-0x000007FEF340D000-memory.dmp
memory/2020-58-0x00000000023AB000-0x00000000023CA000-memory.dmp
memory/2020-59-0x00000000023A4000-0x00000000023A7000-memory.dmp
memory/2020-60-0x00000000023AB000-0x00000000023CA000-memory.dmp