f2ea340a6eaa561e9fa571b190944ba053012f400c0bd82af7ce3d20507e2e2a | Triage

Analysis

max time kernel
374s
max time network
420s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 17:24

Sharing

Report Analysis Logs

General

Target

fix/bluffer.ps1
Size

371B
MD5

125800de40408e58ec84a8605554e7b0
SHA1

8bd9500db14f4c9f1f4b77ed1b295f63b5ff28ec
SHA256

73525b8463cea42ff3f528e718644d79b92c614976ef4d46d8a84b333c35eba7
SHA512

5c9e34964d406995e714ae234f06e44b7a69fdc044cd9b20d396aa29af6ad792cedfa4f564babd28b4a191cd54dc5f054526b01f010ebf9249038dda67238b1e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1776 powershell.exe
1776 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1776 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\bluffer.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-132-0x000002285B780000-0x000002285B7A2000-memory.dmp

Filesize
136KB

Download
memory/1776-133-0x00007FFF68260000-0x00007FFF68D21000-memory.dmp

Filesize
10.8MB

Download
memory/1776-134-0x00007FFF68260000-0x00007FFF68D21000-memory.dmp

Filesize
10.8MB

Download