Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
11-01-2023 21:34
General
-
Target
Invoice6882.ps1
-
Size
283KB
-
MD5
0b2dde0db79812ab9252b566a14fd9fd
-
SHA1
433a751c7263bd232dfe47db23a780df97362c4c
-
SHA256
585ae7767312922f22db853d3a2e9fcfc74c59e8e02f88795135229db16f9f4f
-
SHA512
c1dd8da99b8be3b8ad1c8a569196122aed6d6e59696553151094a5c59a9e6507252d66fd0fd658fabb87d72659a1655805021f106b1269cb04cba2f4bd452ae8
-
SSDEEP
6144:xabRc0KojPVHunAuI5bRr5oI95Zqc43fx:n0KwPVH8cbZA3fx
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Invoice6882.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
10.1MB
-
Filesize
11.4MB
-
Filesize
12KB
-
Filesize
3.0MB
-
Filesize
124KB
-
Filesize
12KB
-
Filesize
124KB