2f0b8c5ea4e7923690e4c4424621c2f00cc40d3c62790a2389addc5ea8ba14a8 | Triage

Analysis

max time kernel
1603s
max time network
1605s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 15:49

Sharing

Report Analysis Logs

General

Target

gm9/scripts/GM9Megascript.ps1
Size

64KB
MD5

5d71540b08e49fa853c1d907d33b0028
SHA1

743c462ae0df9975a10466bc019715b050c493c7
SHA256

ec6de66be12908f1504e42b27f74de4f874409cd98d5dc8c18c1d5e7ff415c17
SHA512

c3c34230d56ac751fdd3b01463a4bc51e97dc07ae20d0b60808dd5f0ae79405d078b8a1164bcb96ac28a5c6b9cd8443e563721fd1bf590ed91546361650ed61c
SSDEEP

1536:ZWCwM89wyFJBYG3LN5a4pjJOvBxMZifZyOKD+S:Z1wMtxMZi4

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

908 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 908 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\gm9\scripts\GM9Megascript.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-58-0x000000001B210000-0x000000001B4F2000-memory.dmp

Filesize
2.9MB

Download
memory/908-59-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/908-60-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/908-61-0x000000000243B000-0x0000000002472000-memory.dmp

Filesize
220KB

Download