20ed61f6c33b42f6c150736afa3c63d0279870e7c7ccac6b251ce1f2d6779b9c | Triage

Analysis

max time kernel
48s
max time network
53s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
10/02/2023, 12:40

Sharing

Report Analysis Logs

General

Target

test.ps1
Size

3KB
MD5

d7fbfad40759a3ed59dfad7622e51fc6
SHA1

0f194fde45b6e92608ee736ef350175d8004f190
SHA256

20ed61f6c33b42f6c150736afa3c63d0279870e7c7ccac6b251ce1f2d6779b9c
SHA512

037e51f88f478635e776e966da876b556e3edc9ba855c7e36e1d51a56c5bd6d548dcba602772622779a59edcf138278d4255200c40941bf76ae5d5a6da5359cb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\test.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-124-0x00000205ADAA0000-0x00000205ADAC2000-memory.dmp

Filesize
136KB

Download
memory/2416-127-0x00000205ADBD0000-0x00000205ADC46000-memory.dmp

Filesize
472KB

Download
memory/2416-170-0x00000205ADA10000-0x00000205ADA60000-memory.dmp

Filesize
320KB

Download
memory/2416-183-0x00000205AD9D0000-0x00000205AD9D8000-memory.dmp

Filesize
32KB

Download