Overview

overview

10

Static

static

1

xas.ps1

windows7-x64

1

xas.ps1

windows10-2004-x64

10

Analysis

  • max time kernel
    27s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2023 14:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xas.ps1

  • Size

    5.0MB

  • MD5

    f8aca613b0d32487540a483fd5f4d3b4

  • SHA1

    8f7492367b9b3f10b420401e91623435b45795ac

  • SHA256

    ef7534cbfb9701ec011fa5354837d6504aa36631e67ee7e328e33e2b751ba413

  • SHA512

    9009bdea9d4c1aa654ab5058e39f00884dc8d1769dd74bf30319d888411aca1a8c5a3f2c679d90072604153b537008a29dc9c13191b9626289f972327eb3a71a

  • SSDEEP

    49152:aY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+f:v

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xas.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2040-58-0x000000001B280000-0x000000001B562000-memory.dmp
    Filesize

    2.9MB

    Download
  • memory/2040-59-0x0000000002530000-0x0000000002538000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2040-60-0x000000001D5B0000-0x000000001D974000-memory.dmp
    Filesize

    3.8MB

    Download
  • memory/2040-61-0x0000000002300000-0x0000000002380000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2040-62-0x0000000002300000-0x0000000002380000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2040-63-0x0000000002300000-0x0000000002380000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2040-64-0x0000000002300000-0x0000000002380000-memory.dmp
    Filesize

    512KB

    Download