Resubmissions
22/10/2023, 07:45
231022-jlnrgsec5z122/10/2023, 07:45
231022-jlfqwaec5x122/10/2023, 07:16
231022-h396dafg39122/10/2023, 07:16
231022-h35kwsdh91122/10/2023, 02:52
231022-dc448aeh48122/10/2023, 00:56
231022-bafyhacg5v121/10/2023, 23:14
231021-28f92ace5w121/10/2023, 23:13
231021-27wnbsed44121/10/2023, 22:55
231021-2v3wwaed24121/10/2023, 22:52
231021-2tp9dsec991Analysis
- max time kernel
127s - max time network
160s - platform
windows10-1703_x64 - resource
win10-20231020-en - resource tags
- submitted
22/10/2023, 02:52
General
- Target script.ps1
- Size 7B
- Sample231022-dc448aeh48
- SHA256 bb2577fdef6d5d1596b10a9b1300dfb84243a8088dda01006dd4357f89f9cc8c
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WinMgmt.exe"C:\Windows\System32\Wbem\WinMgmt.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_m2devdvm.ktp.ps1
memory/1760-4-0x000002C7D1420000-0x000002C7D1442000-memory.dmp
memory/1760-5-0x00007FF847A50000-0x00007FF84843C000-memory.dmp
memory/1760-6-0x000002C7D1310000-0x000002C7D1320000-memory.dmp
memory/1760-7-0x000002C7D1310000-0x000002C7D1320000-memory.dmp
memory/1760-10-0x000002C7D15D0000-0x000002C7D1646000-memory.dmp
memory/1760-23-0x000002C7D1310000-0x000002C7D1320000-memory.dmp
memory/1760-25-0x00007FF847A50000-0x00007FF84843C000-memory.dmp