f6c5d0064568344d3c56561bcc3e6b843a1bba496a4c372f451fe5831d3cce8f | Triage

Resubmissions

09-12-2022 21:30

221209-1cs4aaed56 10

01-12-2022 16:56

221201-vf4fjacg7x 10

Analysis

max time kernel
349s
max time network
410s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 16:56

Sharing

Report Analysis Logs

General

Target

teased/vehemently.ps1
Size

362B
MD5

303ff5de570252c4623e1482e05dc5a2
SHA1

2a3fd1038d4b4071749256e5db1b95c9f7d1ee1a
SHA256

fa84d10f15990f651fac05a1a1eba427cf124589673f6017e88bc173c8a49ed1
SHA512

56e6399a52b57a2332c4e4ebb2441d02474aac5bc8b70efe1e1ce7d2e6c59e2f9ecef7e2995363534ca0996bce6db0f984f6cec55b06108bd085aea211b2db02

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2156 powershell.exe
2156 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2156 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\teased\vehemently.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-132-0x0000024523330000-0x0000024523352000-memory.dmp

Filesize
136KB

Download