Analysis
-
max time kernel
45s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
01/05/2023, 20:20
General
-
Target
PHPExcel/Classes/PHPExcel/Worksheet.ps1
-
Size
90KB
-
MD5
ec9773329eea5e9743073dfa44eda5b1
-
SHA1
c34cd9c98ce70098c6be7bcb22f9f783ac827333
-
SHA256
5c1cb6831bb2d74b8e9982a5862b94141f067b10530ef91fa94782bac994253c
-
SHA512
261d5b5877fd051ac153dfd7fb521d87c38ab9081e403fb738b8d2a970e2b99126469d6934eb33d9df5cda1308602be21bb257f0953bb9722a02b65c3c48124d
-
SSDEEP
1536:JZzKC6Atjk/NQkSomsGJuF/N8N07oMA7oyXBPlQ6Nd21DJ0VaaM2oYBfTjkuhDbA:JBKC6Atjk/NQkSomsGCsBTNd21DJ0m2u
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\PHPExcel\Classes\PHPExcel\Worksheet.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
220KB