Analysis

  • max time kernel
    53s
  • max time network
    73s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-es
  • resource tags

    arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    04/01/2023, 13:57

General

  • Target

    SpotX-Win-main/scripts/installer-lang/hu.ps1

  • Size

    4KB

  • MD5

    1f9d9df92b44b54549b9325b7476780b

  • SHA1

    62cbfef671713d1a49f3386850f43fb8b43b954f

  • SHA256

    c2ca0a174eb820c247b5c9ccfecaaa5f083700c32afcd8b67fe495bbc8fcb76f

  • SHA512

    e4583e52deaa1257c7e904645f86c4637da1708e3650f4649eb571a102eb12b46dfa7490cbb6ceed287dab4ff7ce5a87ef31383f3c3e65f5956378e14f42a582

  • SSDEEP

    96:TANk//Qyni1B8P9xhRfKUBxz0IHMB4tPJYSO:3ABECMSIHk4YSO

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\SpotX-Win-main\scripts\installer-lang\hu.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3996-120-0x000001B124770000-0x000001B1247F2000-memory.dmp

    Filesize

    520KB

  • memory/3996-122-0x000001B124710000-0x000001B124732000-memory.dmp

    Filesize

    136KB

  • memory/3996-123-0x000001B10C200000-0x000001B10C210000-memory.dmp

    Filesize

    64KB

  • memory/3996-124-0x000001B1251A0000-0x000001B1252A2000-memory.dmp

    Filesize

    1.0MB

  • memory/3996-127-0x000001B125330000-0x000001B1253A6000-memory.dmp

    Filesize

    472KB