eb25c71263e04dda90984bfb59c95c867197daed129639c49f4b604304252437

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 03:52

Target

script.ps1
Size

963B
MD5

bb749a55e9594fbb92a180cf1984d914
SHA1

dca75a77ff5833b8d6ef5944be396e337100f2a3
SHA256

eb25c71263e04dda90984bfb59c95c867197daed129639c49f4b604304252437
SHA512

4be3920ed7f0c6a25a76d10b4eba9028eba42f686b8d5808e986b66d51d0b178dfdf798fe54835b353b41490640379ebb90fcaecdbd6cdbf7197f8f875c485fe

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	1892	powershell.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133379276023309822"	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	powershell.exe
1892	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	powershell.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2716

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5kgnzung.nsa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1892-2-0x00000270D91B0000-0x00000270D91D2000-memory.dmp

Filesize
136KB

Download
memory/1892-10-0x00007FFB540E0000-0x00007FFB54BA1000-memory.dmp

Filesize
10.8MB

Download
memory/1892-11-0x00000270D7680000-0x00000270D7690000-memory.dmp

Filesize
64KB

Download
memory/1892-12-0x00000270D7680000-0x00000270D7690000-memory.dmp

Filesize
64KB

Download
memory/1892-13-0x00000270D7680000-0x00000270D7690000-memory.dmp

Filesize
64KB

Download
memory/1892-20-0x00007FFB540E0000-0x00007FFB54BA1000-memory.dmp

Filesize
10.8MB

Download