42378e84d6faee162eb2d969e8089564a3f04148c748255b6012d13de9f0e928

Analysis

max time kernel
229s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.ps1
Size

15B
MD5

decfe067415c6d4432f0a77bbe84d884
SHA1

7e9eab542cf4a759b936eff3e9f7fbc8e4aee62b
SHA256

42378e84d6faee162eb2d969e8089564a3f04148c748255b6012d13de9f0e928
SHA512

5faa8529364643bd4c04b9e9685c76b2cfd676366c4d75581991e6c4922ac73603f5ea9a7da850380f74c2406502cfbcdf14cde9be86fd7833bd287390113831

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	powershell.exe
4164	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeManageVolumePrivilege	1600	svchost.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0gjetnn1.1b1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1600-62-0x0000019F76BD0000-0x0000019F76BD1000-memory.dmp

Filesize
4KB

Download
memory/1600-61-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-53-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-86-0x0000019F76D10000-0x0000019F76D11000-memory.dmp

Filesize
4KB

Download
memory/1600-54-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-83-0x0000019F76D00000-0x0000019F76D01000-memory.dmp

Filesize
4KB

Download
memory/1600-55-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-71-0x0000019F76B00000-0x0000019F76B01000-memory.dmp

Filesize
4KB

Download
memory/1600-68-0x0000019F76BC0000-0x0000019F76BC1000-memory.dmp

Filesize
4KB

Download
memory/1600-65-0x0000019F76BD0000-0x0000019F76BD1000-memory.dmp

Filesize
4KB

Download
memory/1600-19-0x0000019F6E890000-0x0000019F6E8A0000-memory.dmp

Filesize
64KB

Download
memory/1600-35-0x0000019F6E990000-0x0000019F6E9A0000-memory.dmp

Filesize
64KB

Download
memory/1600-51-0x0000019F76F80000-0x0000019F76F81000-memory.dmp

Filesize
4KB

Download
memory/1600-52-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-87-0x0000019F76E20000-0x0000019F76E21000-memory.dmp

Filesize
4KB

Download
memory/1600-85-0x0000019F76D10000-0x0000019F76D11000-memory.dmp

Filesize
4KB

Download
memory/1600-63-0x0000019F76BC0000-0x0000019F76BC1000-memory.dmp

Filesize
4KB

Download
memory/1600-56-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-57-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-58-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-59-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/1600-60-0x0000019F76FB0000-0x0000019F76FB1000-memory.dmp

Filesize
4KB

Download
memory/4164-10-0x00007FFB646B0000-0x00007FFB65171000-memory.dmp

Filesize
10.8MB

Download
memory/4164-9-0x000001C616D90000-0x000001C616DB2000-memory.dmp

Filesize
136KB

Download
memory/4164-15-0x00007FFB646B0000-0x00007FFB65171000-memory.dmp

Filesize
10.8MB

Download
memory/4164-18-0x000001C62F2B0000-0x000001C62F2C0000-memory.dmp

Filesize
64KB

Download
memory/4164-17-0x000001C62F2B0000-0x000001C62F2C0000-memory.dmp

Filesize
64KB

Download
memory/4164-16-0x000001C62F2B0000-0x000001C62F2C0000-memory.dmp

Filesize
64KB

Download
memory/4164-14-0x000001C62F730000-0x000001C62F754000-memory.dmp

Filesize
144KB

Download
memory/4164-13-0x000001C62F730000-0x000001C62F75A000-memory.dmp

Filesize
168KB

Download
memory/4164-12-0x000001C62F2B0000-0x000001C62F2C0000-memory.dmp

Filesize
64KB

Download
memory/4164-11-0x000001C62F2B0000-0x000001C62F2C0000-memory.dmp

Filesize
64KB

Download