585ae7767312922f22db853d3a2e9fcfc74c59e8e02f88795135229db16f9f4f | Triage

Analysis

max time kernel
229s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2023 21:34

Sharing

Report Analysis Logs

General

Target

Invoice6882.ps1
Size

283KB
MD5

0b2dde0db79812ab9252b566a14fd9fd
SHA1

433a751c7263bd232dfe47db23a780df97362c4c
SHA256

585ae7767312922f22db853d3a2e9fcfc74c59e8e02f88795135229db16f9f4f
SHA512

c1dd8da99b8be3b8ad1c8a569196122aed6d6e59696553151094a5c59a9e6507252d66fd0fd658fabb87d72659a1655805021f106b1269cb04cba2f4bd452ae8
SSDEEP

6144:xabRc0KojPVHunAuI5bRr5oI95Zqc43fx:n0KwPVH8cbZA3fx

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	powershell.exe
4736	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Invoice6882.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x240 0x408
1⤵
PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-132-0x000002AA23500000-0x000002AA23522000-memory.dmp

Filesize
136KB

Download
memory/4736-133-0x00007FF980870000-0x00007FF981331000-memory.dmp

Filesize
10.8MB

Download
memory/4736-134-0x00007FF980870000-0x00007FF981331000-memory.dmp

Filesize
10.8MB

Download