Analysis
- max time kernel
396s - max time network
383s - platform
windows10-1703_x64 - resource
win10-20231025-en - resource tags
- submitted
02/11/2023, 13:35
General
- Target 7za32.exe
- Size 721KB
- Sample231102-qv24ssce81
- SHA256 8e679f87ba503f3dfad96266ca79de7bfe3092dc6a58c0fe0438f7d4b19f0bbd
Score
10/10
Malware Config
Signatures
- match_everything 10 IoCs
This rule matches all.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7za32.exe"C:\Users\Admin\AppData\Local\Temp\7za32.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bqgsapwl.eim.ps1
memory/1268-6-0x00007FFF510C0000-0x00007FFF51AAC000-memory.dmp
memory/1268-8-0x0000028CE29A0000-0x0000028CE29B0000-memory.dmp
memory/1268-7-0x0000028CE29A0000-0x0000028CE29B0000-memory.dmp
memory/1268-9-0x0000028CE2A60000-0x0000028CE2A82000-memory.dmp
memory/1268-36-0x0000028CE3030000-0x0000028CE306C000-memory.dmp
memory/1268-47-0x0000028CE30F0000-0x0000028CE3166000-memory.dmp
memory/1268-52-0x00007FFF510C0000-0x00007FFF51AAC000-memory.dmp
memory/1268-53-0x0000028CE29A0000-0x0000028CE29B0000-memory.dmp
memory/1268-54-0x0000028CE29A0000-0x0000028CE29B0000-memory.dmp