9667a956c8dde7fcd6e17f27f7e8219679e381d65c2077d5d05df06e3c923cbe | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 12:46

Sharing

Report Analysis Logs

General

Target

wXUqQw2i.ps1
Size

14KB
MD5

4c96a37db5c576faa17dc5b18937309d
SHA1

22307b8ed479b73a27a97bd78bf56082419f3905
SHA256

9667a956c8dde7fcd6e17f27f7e8219679e381d65c2077d5d05df06e3c923cbe
SHA512

5d64d5eafb5734115efb29cb56f12f58043a11912941431ec1e572d2ba2aa941d0d6da1006e6b073df47e332cd3e6cdef9c51fafe1bda40d79d0de464b3eb23e
SSDEEP

192:iMofEik/qcRr54E2E4iKDWKQMM41k1LlOqcRr54E2E4iKDWKQMM41fr:iMofEik3/4dKKQ74C5k/4dKKQ74R

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2016	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wXUqQw2i.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-58-0x000000001B1A0000-0x000000001B482000-memory.dmp

Filesize
2.9MB

Download
memory/2016-59-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/2016-60-0x0000000002414000-0x0000000002417000-memory.dmp

Filesize
12KB

Download
memory/2016-61-0x000000000241B000-0x0000000002452000-memory.dmp

Filesize
220KB

Download