Analysis
- max time kernel
616s - max time network
1607s - platform
windows10-1703_x64 - resource
win10-20230220-en - resource tags
- submitted
08/04/2023, 18:45
General
- Target trigger.ps1
- Size 789B
- Sample230408-xd7raaef79
- SHA256 40629145959cd05252bb4da657364c4f999a8e5f2d8f8fce02b3a2d2d3bd55e9
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps11⤵
- Blocklisted process makes network request
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5zm2nvz2.mlc.ps1
memory/4144-122-0x00000200682B0000-0x00000200682D2000-memory.dmp
memory/4144-123-0x000002004C440000-0x000002004C450000-memory.dmp
memory/4144-124-0x000002004C440000-0x000002004C450000-memory.dmp
memory/4144-129-0x0000020068460000-0x00000200684D6000-memory.dmp
memory/4144-144-0x000002004C440000-0x000002004C450000-memory.dmp