ae6e21901ced549e39087ba03abf3c792c1e897f0f7f50fc2bb2d908d43cd8d7 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/05/2023, 12:58

Sharing

Report Analysis Logs

General

Target

vd.ps1
Size

10KB
MD5

860094e8e996bdb01545981462761443
SHA1

666dd73ce455402e35e6c4d552631299654a8228
SHA256

ae6e21901ced549e39087ba03abf3c792c1e897f0f7f50fc2bb2d908d43cd8d7
SHA512

714c725631020a2975a62a491b86a2100e9357e00e2c5d1cc05110254fed31a48f00f4628027fe7cd418e3ffc8ba65d1cd62433a1f8871203d390a2058a3e41f
SSDEEP

192:rlYHC0HNXGZkHQU7ydPJq5S2KqQVX/uTK3w3DK+tMy47R/Ga0kVhFuPwf8Pn93Jq:FVGaRF8I8ICzRv+Ii

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\vd.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-58-0x000000001B220000-0x000000001B502000-memory.dmp

Filesize
2.9MB

Download
memory/2044-59-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2044-60-0x00000000029C4000-0x00000000029C7000-memory.dmp

Filesize
12KB

Download
memory/2044-61-0x00000000029CB000-0x0000000002A02000-memory.dmp

Filesize
220KB

Download