933d6b9342fe41029811e6fb72ee829cc5572aafce3c400ffd5deead9151f2b0 | Triage

Analysis

max time kernel
73s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2022 17:29

Sharing

Report Analysis Logs

General

Target

mal.ps1
Size

1KB
MD5

58f0a9311e6ed72600efaf89d460df49
SHA1

3359a26c578698fa6c9dbb210e8ffdd696000d1e
SHA256

933d6b9342fe41029811e6fb72ee829cc5572aafce3c400ffd5deead9151f2b0
SHA512

ed2783c73d3de7e7906b107a72123bac532b3c4b3291a452978fcc6b6baa7df585820394626d82947ef5023bcf848cf8114141d09cbee019263aea27353c9690

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
980	powershell.exe
980	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mal.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-132-0x000001D8431D0000-0x000001D8431F2000-memory.dmp

Filesize
136KB

Download
memory/980-133-0x00007FFC10A80000-0x00007FFC11541000-memory.dmp

Filesize
10.8MB

Download
memory/980-134-0x00007FFC10A80000-0x00007FFC11541000-memory.dmp

Filesize
10.8MB

Download