10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d

Analysis

max time kernel
70s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 16:07

Target

GDHM_TASBOT_v35.6/locales/et.ps1
Size

365KB
MD5

f053123bc4a671fe578a157fb2492085
SHA1

0a24eea3611a919b2631c8c028d4eef866e6835f
SHA256

2e092178532ea4c65c2524c09eb6d2a2cc0aa1f4bb18fcbf3ffa696b9b3df785
SHA512

7cac44bb9b27b692b6469ddcbcef5a262f2a4ae2f25b6eb4eb6044c613cf0fdd7bc1c32f3fc983dc8bd7c0c11325ae84a670d2fc737b9a54064e3fbfae21d60b
SSDEEP

6144:Pb1bXAyruOH+yzZpDM04jRy2zmJbT/RcLviLVG59j643ueLfTPQD:DZFruNyrDwuXG59jM

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4196 powershell.exe
4196 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4196 powershell.exe

pid	process
4196	powershell.exe
4196	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4196	powershell.exe

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tk4qcov1.x3q.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4196-142-0x000001F1B2230000-0x000001F1B2252000-memory.dmp

Filesize
136KB

Download
memory/4196-143-0x000001F1B2290000-0x000001F1B22A0000-memory.dmp

Filesize
64KB

Download
memory/4196-144-0x000001F1B2290000-0x000001F1B22A0000-memory.dmp

Filesize
64KB

Download