3960f84cc0ea0fc8378ec44f2d214a0b93f6709161b6e06f8581fadf87488f43 | Triage

Analysis

max time kernel
90s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2023, 14:44

Sharing

Report Analysis Logs

General

Target

run.ps1
Size

242B
MD5

efdfe081c5cebb04d2cc7c4737d2a7f4
SHA1

2dfdadc83aea13f35c5a42090ac66928c7339ac6
SHA256

3960f84cc0ea0fc8378ec44f2d214a0b93f6709161b6e06f8581fadf87488f43
SHA512

865b7a634a57a04fa1874176599af0b42342d304ef2114c16b77da2737614553c39a170d9788aa40b756faf12a530ae5de4da866088eb7341b0b117579f93031

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4856-132-0x000001F62E3C0000-0x000001F62E3E2000-memory.dmp

Filesize
136KB

Download
memory/4856-133-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/4856-134-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download