Analysis
- max time kernel
416s - max time network
421s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
02/11/2023, 13:35
General
- Target 7za32.exe
- Size 721KB
- Sample231102-qv24ssce81
- SHA256 8e679f87ba503f3dfad96266ca79de7bfe3092dc6a58c0fe0438f7d4b19f0bbd
Score
10/10
Malware Config
Signatures
- match_everything 10 IoCs
This rule matches all.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7za32.exe"C:\Users\Admin\AppData\Local\Temp\7za32.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_s1evgfw3.krk.ps1
memory/2140-2-0x00000264C6A30000-0x00000264C6A52000-memory.dmp
memory/2140-12-0x00007FFFA8DD0000-0x00007FFFA9891000-memory.dmp
memory/2140-13-0x00000264C6AC0000-0x00000264C6AD0000-memory.dmp
memory/2140-14-0x00000264C6AC0000-0x00000264C6AD0000-memory.dmp
memory/2140-15-0x00000264C70D0000-0x00000264C7114000-memory.dmp
memory/2140-16-0x00000264C71A0000-0x00000264C7216000-memory.dmp
memory/2140-17-0x00007FFFA8DD0000-0x00007FFFA9891000-memory.dmp
memory/2140-18-0x00000264C6AC0000-0x00000264C6AD0000-memory.dmp
memory/2140-19-0x00000264C6AC0000-0x00000264C6AD0000-memory.dmp