Overview

overview

10

Static

static

1

4959354bc8...80.ps1

windows7-x64

1

4959354bc8...80.ps1

windows10-2004-x64

10

Analysis

  • max time kernel
    130s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2023 10:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80.ps1

  • Size

    430KB

  • MD5

    3522c1f7f4328df9bcd67cf7aad28eae

  • SHA1

    4b91582c6fc365877b23dce2b3a7782dd3dd057f

  • SHA256

    4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80

  • SHA512

    c3f466a4435b0d89fe72b913e422347a855f8179b95a8fd4dafde8108a6eac7d7c52404076342cc876e82ca83885a0dadbceb4d9fcb9c4a99f7dd30b2c960d18

  • SSDEEP

    3072:w4xxUF6xj08315d3Apo4ypzUeE6Ue+VM8fpBTUv1vZuWQIG7Dl8a:w4xxeQj08315d3Apo0VNRBRWQIM

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2724-6-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2724-5-0x000000001B260000-0x000000001B542000-memory.dmp
    Filesize

    2.9MB

    Download
  • memory/2724-7-0x0000000002560000-0x0000000002568000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2724-8-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2724-10-0x00000000025A0000-0x0000000002620000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2724-9-0x00000000025A0000-0x0000000002620000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2724-11-0x00000000025A0000-0x0000000002620000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2724-12-0x00000000025A0000-0x0000000002620000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2724-13-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2724-14-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2724-15-0x00000000025A0000-0x0000000002620000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2724-16-0x00000000025A0000-0x0000000002620000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2724-17-0x00000000025A0000-0x0000000002620000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2724-18-0x00000000025A0000-0x0000000002620000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2724-19-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp
    Filesize

    9.6MB

    Download