6cc6ab0be1edf432d9ce64e543b8b497acfd42096ecca8065e84930c84afde3a | Triage

Analysis

max time kernel
18s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 11:29

Sharing

Report Analysis Logs

General

Target

partial.ps1
Size

2.5MB
MD5

da4df96bc801d0948250e4ae400326c0
SHA1

3e6e0d048fafc2787ac7f69a9ff3a71a03b5112e
SHA256

b54672357b1092323b3f35d63ba3fb59bf71fdf678d69cacb8135d75359009f5
SHA512

cc7a771201940e98686891e69d5fc17135775b4dadae4665e4f71290e1f2b4da5dc9553331c71ae534fefee1a2af7d24552f5a0cb3c76e70577705237a388f5b
SSDEEP

49152:e2NpAkI/CV2as4MY3HRuRhCxFDvz0ytWLFDvz0ytW2p:FpAkmqrMY3xAhT

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\partial.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-58-0x000000001B0C0000-0x000000001B3A2000-memory.dmp

Filesize
2.9MB

Download
memory/1980-59-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/1980-60-0x0000000002504000-0x0000000002507000-memory.dmp

Filesize
12KB

Download
memory/1980-61-0x000000000250B000-0x0000000002542000-memory.dmp

Filesize
220KB

Download