33c21bf2e0c7f058fc2d76c9fa41e7fa203b1793b45ea61fec551186998f709a | Triage

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2022, 14:33

Sharing

Report Analysis Logs

General

Target

ChrisTitusTech_debloatWin10_elQueAnda/cttscript/HyperV Tools/vm-gpusplit.ps1
Size

1006B
MD5

a60cc7ec87f3d361e24ee50c3157ec77
SHA1

388f90571d44264ca8ea001d8be1234116e75c1f
SHA256

ebbdc439cea1ef2f5f8a77fdca7353ecb328180f3d83e162da4b4e5fcbaa9eb0
SHA512

d05f9706441ad588b4091bc43bec5c99a794ea48271f30e4a9486877b67f396a57563e56fa5609da2e4e03abfeebf0c06c7bf542f81d1cce0dcc61a8008036ce

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3104	powershell.exe
3104	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3104	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\ChrisTitusTech_debloatWin10_elQueAnda\cttscript\HyperV Tools\vm-gpusplit.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3104-132-0x000002930F830000-0x000002930F852000-memory.dmp

Filesize
136KB

Download
memory/3104-133-0x00007FF852980000-0x00007FF853441000-memory.dmp

Filesize
10.8MB

Download
memory/3104-134-0x00007FF852980000-0x00007FF853441000-memory.dmp

Filesize
10.8MB

Download