a46e551c1aba904f1f66059ee491ae088f6952389dfbdc8571ac5080ec11d137 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/05/2023, 19:03

Sharing

Report Analysis Logs

General

Target

EntityFramework.ps1
Size

43KB
MD5

83fee42f2be99ea6ef9fc5892d4b61bf
SHA1

87f0eecdc132ce46e9506ff422410ec4000b82ac
SHA256

a46e551c1aba904f1f66059ee491ae088f6952389dfbdc8571ac5080ec11d137
SHA512

d7868971a6b9bc4596bfce685f3c3d91d55a80047bf413ed5a2390bd761d4d0101b5af0e0d00606c0324fbf2c3f7167038e47437a2432df204588226ca47df09
SSDEEP

768:NLKVIoii6uiOgB9Qf8Ev2Omlgc/9CzHK7G5QIHL31D8Wv/:NLeIoii63OgB9Qf8e2OmlgE9CLK7pWNb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1444	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\EntityFramework.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-58-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/1444-59-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/1444-60-0x00000000022E4000-0x00000000022E7000-memory.dmp

Filesize
12KB

Download
memory/1444-61-0x00000000022EB000-0x0000000002322000-memory.dmp

Filesize
220KB

Download