0b33ce3a64948d8886506dc6da63da3a1474b6f7fa909485425503f2d4faaca4 | Triage

Analysis

max time kernel
73s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 16:19

Sharing

Report Analysis Logs

General

Target

normal.ps1
Size

7KB
MD5

19606d43d09004abffc55a6089e24ffb
SHA1

8dc633c113894ed54b2b443c19911b9b243dbcdc
SHA256

0b33ce3a64948d8886506dc6da63da3a1474b6f7fa909485425503f2d4faaca4
SHA512

1baeaffb7154e99f3d64adaa7e9eb874ec718c291ab082a1adab2f4f621b00f3c32836257e7ce9fe2ae7cdfbfd581ce9af185e6f989d858212e668bdb9096169
SSDEEP

192:RKweKQ8H6riaEv5eqqHOZ6wdWfElVE3T3AwlrpTiUOduHSfe:AweK11aEv5hqAZ1lO3LAwNpTiU+uHSfe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	powershell.exe
4624	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\normal.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4624-132-0x000001D771430000-0x000001D771452000-memory.dmp

Filesize
136KB

Download
memory/4624-133-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

Filesize
10.8MB

Download
memory/4624-134-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

Filesize
10.8MB

Download
memory/4624-135-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

Filesize
10.8MB

Download