Analysis
-
max time kernel
272s -
max time network
288s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
05-12-2022 17:45
General
-
Target
8969122ef3485df.ps1
-
Size
424KB
-
MD5
7e17e5f94d45e854c6855f557d4c3b62
-
SHA1
dc1894577c77ea178a40510d676fc31e4049bce3
-
SHA256
d19fc72db9725c704b88f4dbf52fdc11d609d6adeedaafa8b79ca76dc7da12c2
-
SHA512
80f6dbc86f5825b5935d775614e531981fcd0d768092e83f6e364514ae6ec868b916d057c739f0cf8e2226aa5a495f72d1aafed1b9196a9ce5976994be38b6bd
-
SSDEEP
6144:cJg4cOlXYM0DPGj7fw0xB2pPBrGyMsY7iGBa5fIoYAUdfv05Xs0lHBMjMlzN0s:cu4cO+MkPGI4MpPBrCi1B+05Xll90s
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8969122ef3485df.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5100-132-0x0000029A28E60000-0x0000029A28E82000-memory.dmpFilesize
136KB
-
memory/5100-133-0x00007FFCA7CE0000-0x00007FFCA87A1000-memory.dmpFilesize
10.8MB
-
memory/5100-134-0x00007FFCA7CE0000-0x00007FFCA87A1000-memory.dmpFilesize
10.8MB
-
memory/5100-135-0x0000029A29940000-0x0000029A29980000-memory.dmpFilesize
256KB
-
memory/5100-136-0x0000029A29940000-0x0000029A29980000-memory.dmpFilesize
256KB