0d20d075cf8e97e778f907255f5d6fe18de6f7d0da42c7bc2af700a2f69b72b1 | Triage

Analysis

max time kernel
89s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2023, 17:32

Sharing

Report Analysis Logs

General

Target

data/scripts/Edge/Run MSEdgeRedirect.ps1
Size

454B
MD5

4914fc61ff83a0744e436faaf981cf68
SHA1

a13a218577a1630286b480eb7837d6cbf40d1d2e
SHA256

e3a7cad70ae21c412b02ff7a8f306940d386189de6590139101e3242d2e4a37e
SHA512

c20e656741a3149a242a87bdb45aa286db1495b588b80981e5c513ce8303084d02cf90abedf01616ee3e578c3b0bcd976a1d2bb338af3501d9bc9baeae96e8f9

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	4636	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4636	powershell.exe
4636	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\data\scripts\Edge\Run MSEdgeRedirect.ps1"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-132-0x000002721BA20000-0x000002721BA42000-memory.dmp

Filesize
136KB

Download
memory/4636-133-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/4636-134-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download