95d61936009adb7487b7601c8e58491f0758d9283c466e39112322c5bbaf6f53 | Triage

Analysis

max time kernel
97s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2022, 01:58

Sharing

Report Analysis Logs

General

Target

43de3331fb549334b316e9815f81adf79f40944587cad30a7058c98028f8cf1b.ps1
Size

1KB
MD5

64448dbfbd23911163805a95a24a0aa5
SHA1

9de38c8a0f5c2d19940170e9b635770854aa52a0
SHA256

43de3331fb549334b316e9815f81adf79f40944587cad30a7058c98028f8cf1b
SHA512

cc6008808b95ea6e4bd80979d2362328097250177b781470436c9da673aac63ef1ac600261174900554ad886568844014ef08bba19c1f2b7012ef4b061637373

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2440	powershell.exe
2440	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\43de3331fb549334b316e9815f81adf79f40944587cad30a7058c98028f8cf1b.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-132-0x00000192F03F0000-0x00000192F0412000-memory.dmp

Filesize
136KB

Download
memory/2440-133-0x00007FFAAED70000-0x00007FFAAF831000-memory.dmp

Filesize
10.8MB

Download
memory/2440-134-0x00007FFAAED70000-0x00007FFAAF831000-memory.dmp

Filesize
10.8MB

Download