e4460dc20a3a9b45a43013e677f809fc2f8fd35a0b31dfaec7cb4670181c7754

Analysis

max time kernel
133s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 05:49

Target

Pegasus HVNC client/PegasusHVNCclient-main/Peg/ICARUS/IMSA.ps1
Size

1KB
MD5

a1eb0909bf24bfa12acccff60878b750
SHA1

ce7a6fa4e1dfeab87d75a7b54969bbefd0a61866
SHA256

776d814a64cd9ef33f4de204b7e2d842dac411b3deabde91bc54a7c81a10d1c0
SHA512

06e8f3583c3b25e7a2e4498cc3b4e4bab8d61ff1943b11a45767d2c788f501fc61e596dfa4ec52d915f00e7dbc943e1d2a29a0dbf4f4beaa403ebfcf00fefd16

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4044 powershell.exe
4044 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4044 powershell.exe

pid	process
4044	powershell.exe
4044	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4044	powershell.exe

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2alol231.ikk.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4044-142-0x000001DBEF780000-0x000001DBEF7A2000-memory.dmp

Filesize
136KB

Download
memory/4044-143-0x000001DBEC980000-0x000001DBEC990000-memory.dmp

Filesize
64KB

Download
memory/4044-144-0x000001DBEC980000-0x000001DBEC990000-memory.dmp

Filesize
64KB

Download
memory/4044-145-0x000001DBEC980000-0x000001DBEC990000-memory.dmp

Filesize
64KB

Download