95d61936009adb7487b7601c8e58491f0758d9283c466e39112322c5bbaf6f53 | Triage

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2022, 01:58

Sharing

Report Analysis Logs

General

Target

b860e96dc5c470d52edb8c72d160f7be604a0e367378dd0bc1baf203f2dee989.ps1
Size

1KB
MD5

9c3b4b443258d29e24f525a927f9e62b
SHA1

01ee429e90ce96acedfeea9fa6297fa9848bb13a
SHA256

b860e96dc5c470d52edb8c72d160f7be604a0e367378dd0bc1baf203f2dee989
SHA512

20654ae67e91d03291f75de0f549c79fd1ae21966558957153bc7481638b74b8318ce9136787dc78720419cabe2410398f40b11f6d007e06282de85700b8033a

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	powershell.exe
4328	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b860e96dc5c470d52edb8c72d160f7be604a0e367378dd0bc1baf203f2dee989.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4328-132-0x000002BBB7A50000-0x000002BBB7A72000-memory.dmp

Filesize
136KB

Download
memory/4328-133-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmp

Filesize
10.8MB

Download
memory/4328-134-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmp

Filesize
10.8MB

Download