Analysis
-
max time kernel
19s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 09:44
Static task
static1
Behavioral task
behavioral1
Sample
red.ps1
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
red.ps1
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
red.ps1
-
Size
420KB
-
MD5
8deb78e7465c7aa01dce0f7b56afd75a
-
SHA1
46dfe591424f1c811c6da80b81ca3962e8667588
-
SHA256
1f531a7a7e0024d96701bd6c09c97cda0e56690deb7b53b9b855017000bf0baa
-
SHA512
c6a9d751ab704d5c7ea56f4b7377b2e6a81e4f1098b6765ece65685dab39289ead9f869bd6913b14b36e7379bc947c2392d42e6e2dc8020f098d63fb7588cda1
-
SSDEEP
6144:cRRIHFh8pCFAECNTT0vgPq+jscEI+ZVF10o+mjgQrsSJI5ELFTVoZphtyUfku2wy:cPCFST04y+0hVjbihU
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1832 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1832-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmpFilesize
8KB
-
memory/1832-55-0x000007FEF4090000-0x000007FEF4AB3000-memory.dmpFilesize
10.1MB
-
memory/1832-57-0x00000000026A4000-0x00000000026A7000-memory.dmpFilesize
12KB
-
memory/1832-56-0x000007FEEF080000-0x000007FEEFBDD000-memory.dmpFilesize
11.4MB
-
memory/1832-58-0x00000000026AB000-0x00000000026CA000-memory.dmpFilesize
124KB
-
memory/1832-59-0x00000000026A4000-0x00000000026A7000-memory.dmpFilesize
12KB