9e74e1ae350afd6f316c33b3427981fd530febeefbd1ab8459285c96894154c0

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 23:52

Target

target.ps1
Size

121B
MD5

369e6e01f012a3636701931309cb08b3
SHA1

e0e9f33a840cdb4f7f65f396b2a41e682de821e3
SHA256

9e74e1ae350afd6f316c33b3427981fd530febeefbd1ab8459285c96894154c0
SHA512

6c6dcf015275131f9dda172d31b6e86801e733b2ce0103e1638d1c93d7feb612f79feda787647dc4c3f68c8a89d591088dd9b4b93ed133fac1d5441caf50c983

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3264	powershell.exe
3264	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeIncreaseQuotaPrivilege	3264	powershell.exe
Token: SeSecurityPrivilege	3264	powershell.exe
Token: SeTakeOwnershipPrivilege	3264	powershell.exe
Token: SeLoadDriverPrivilege	3264	powershell.exe
Token: SeSystemProfilePrivilege	3264	powershell.exe
Token: SeSystemtimePrivilege	3264	powershell.exe
Token: SeProfSingleProcessPrivilege	3264	powershell.exe
Token: SeIncBasePriorityPrivilege	3264	powershell.exe
Token: SeCreatePagefilePrivilege	3264	powershell.exe
Token: SeBackupPrivilege	3264	powershell.exe
Token: SeRestorePrivilege	3264	powershell.exe
Token: SeShutdownPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeSystemEnvironmentPrivilege	3264	powershell.exe
Token: SeRemoteShutdownPrivilege	3264	powershell.exe
Token: SeUndockPrivilege	3264	powershell.exe
Token: SeManageVolumePrivilege	3264	powershell.exe
Token: 33	3264	powershell.exe
Token: 34	3264	powershell.exe
Token: 35	3264	powershell.exe
Token: 36	3264	powershell.exe

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vvprbqvm.ojj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3264-0-0x000001FEC4F00000-0x000001FEC4F22000-memory.dmp

Filesize
136KB

Download
memory/3264-10-0x00007FF97C610000-0x00007FF97D0D1000-memory.dmp

Filesize
10.8MB

Download
memory/3264-11-0x000001FEC4640000-0x000001FEC4650000-memory.dmp

Filesize
64KB

Download
memory/3264-13-0x000001FEC4640000-0x000001FEC4650000-memory.dmp

Filesize
64KB

Download
memory/3264-12-0x000001FEC4640000-0x000001FEC4650000-memory.dmp

Filesize
64KB

Download
memory/3264-16-0x00007FF97C610000-0x00007FF97D0D1000-memory.dmp

Filesize
10.8MB

Download