Analysis

  • max time kernel
    39s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2023 17:32

General

  • Target

    data/scripts/Apps/Update Store apps.ps1

  • Size

    306B

  • MD5

    b0956f3ca1276f88a8f2246c898709a8

  • SHA1

    4f32b0e3aab2007c4af64e72cc51c35ea73b6e37

  • SHA256

    b0d81c299986e4b1ee94ae08cff05f370a8b07bfb43a5d89585d13b2307c3521

  • SHA512

    9fbc756c1d15f529a53202a4c4ebef249cf0e9e89be90f69b4fadc364444679ab6e876f1a3e7b3e3134ae0e3459aaafba457b12cc0d49690a90016cf21e562bd

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\data\scripts\Apps\Update Store apps.ps1"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/884-54-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

    Filesize

    8KB

  • memory/884-55-0x000007FEF3AA0000-0x000007FEF44C3000-memory.dmp

    Filesize

    10.1MB

  • memory/884-56-0x000007FEF2F40000-0x000007FEF3A9D000-memory.dmp

    Filesize

    11.4MB

  • memory/884-57-0x0000000002464000-0x0000000002467000-memory.dmp

    Filesize

    12KB

  • memory/884-58-0x000000001B770000-0x000000001BA6F000-memory.dmp

    Filesize

    3.0MB

  • memory/884-59-0x0000000002464000-0x0000000002467000-memory.dmp

    Filesize

    12KB

  • memory/884-60-0x000000000246B000-0x000000000248A000-memory.dmp

    Filesize

    124KB