838ceb715f6a2cf668b9e9a2a7adf1f12514bb919f8f63336f2972af8d9a1dee | Triage

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2023, 15:57

Sharing

Report Analysis Logs

General

Target

aa3cef8ba3e68fdaeb122b3c6e71e473.ps1
Size

1KB
MD5

aa3cef8ba3e68fdaeb122b3c6e71e473
SHA1

5ba7aa3bf6433446bebe6c0e9d078d6ea2545a18
SHA256

838ceb715f6a2cf668b9e9a2a7adf1f12514bb919f8f63336f2972af8d9a1dee
SHA512

54c8cb96013ec83b25a3a2462bf307f21a8eac76730b5705525141a1757509a7c49bb23fe88afd922d037da453f24645d893e6638c7ce124f03a20f9e68a8491

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\aa3cef8ba3e68fdaeb122b3c6e71e473.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4868-132-0x000002121BF70000-0x000002121BF92000-memory.dmp

Filesize
136KB

Download
memory/4868-133-0x00007FFB86920000-0x00007FFB873E1000-memory.dmp

Filesize
10.8MB

Download
memory/4868-134-0x00007FFB86920000-0x00007FFB873E1000-memory.dmp

Filesize
10.8MB

Download