Analysis

  • max time kernel
    29s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2023, 07:57

General

  • Target

    09698999.ps1

  • Size

    659B

  • MD5

    1fd68f9a08b4bb1d729209b8f2ac2f88

  • SHA1

    fc3ae0b71f63eff2d2b640aa5e3238b81dff4ffd

  • SHA256

    76df6e227d710685cefd5b68a320f8d99129609103d881d4d1ebd9413c8eb2a2

  • SHA512

    e72f9dd46d14e37a278c49e80f8a605e93c902d0f8161dd713a15389ae1eb5938b63e3c330ee166967aa1d85c159dbee2012df060525b811f59d873b74f63c74

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\09698999.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1236

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1236-58-0x000000001B290000-0x000000001B572000-memory.dmp

          Filesize

          2.9MB

        • memory/1236-59-0x0000000002310000-0x0000000002318000-memory.dmp

          Filesize

          32KB

        • memory/1236-61-0x00000000027F0000-0x0000000002870000-memory.dmp

          Filesize

          512KB

        • memory/1236-60-0x00000000027F0000-0x0000000002870000-memory.dmp

          Filesize

          512KB

        • memory/1236-62-0x00000000027F0000-0x0000000002870000-memory.dmp

          Filesize

          512KB