Analysis
-
max time kernel
40s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-11-2022 14:47
General
-
Target
stub.ps1
-
Size
228KB
-
MD5
2041e64bffccfbc9379235fdf294f188
-
SHA1
19c1fd78e8f36493e2a9b1c0e437afc2416586f8
-
SHA256
daa4362a762a472f717a480102883382b41dc5c17484f649272c5bdb5142917c
-
SHA512
c5d5be4615767483432287d3486e805d6744d45a5eac6445cef87ce1e8475bcdbb521dcd8d1c7918d8d73d6634617842b67290bc4fb734a4ab31dfe7daaaec13
-
SSDEEP
6144:AdCb38V4N80EC7PAdpJZrLZ9u4zDdyxGu8VnNQUC:AdCb38V4N80EC7PAdzZrLZ9u4zDdyxGG
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\stub.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1728-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmpFilesize
8KB
-
memory/1728-55-0x000007FEF33F0000-0x000007FEF3E13000-memory.dmpFilesize
10.1MB
-
memory/1728-57-0x0000000002584000-0x0000000002587000-memory.dmpFilesize
12KB
-
memory/1728-56-0x000007FEF2890000-0x000007FEF33ED000-memory.dmpFilesize
11.4MB
-
memory/1728-58-0x000000000258B000-0x00000000025AA000-memory.dmpFilesize
124KB
-
memory/1728-59-0x0000000002584000-0x0000000002587000-memory.dmpFilesize
12KB
-
memory/1728-60-0x000000000258B000-0x00000000025AA000-memory.dmpFilesize
124KB