585ae7767312922f22db853d3a2e9fcfc74c59e8e02f88795135229db16f9f4f | Triage

Analysis

max time kernel
145s
max time network
179s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
11-01-2023 21:34

Sharing

Report Analysis Logs

General

Target

Invoice6882.ps1
Size

283KB
MD5

0b2dde0db79812ab9252b566a14fd9fd
SHA1

433a751c7263bd232dfe47db23a780df97362c4c
SHA256

585ae7767312922f22db853d3a2e9fcfc74c59e8e02f88795135229db16f9f4f
SHA512

c1dd8da99b8be3b8ad1c8a569196122aed6d6e59696553151094a5c59a9e6507252d66fd0fd658fabb87d72659a1655805021f106b1269cb04cba2f4bd452ae8
SSDEEP

6144:xabRc0KojPVHunAuI5bRr5oI95Zqc43fx:n0KwPVH8cbZA3fx

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Invoice6882.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x39c
1⤵
PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-121-0x0000023D4CB70000-0x0000023D4CB92000-memory.dmp

Filesize
136KB

Download
memory/3828-124-0x0000023D4D6D0000-0x0000023D4D746000-memory.dmp

Filesize
472KB

Download