Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2023, 12:53

General

  • Target

    add_acl.ps1

  • Size

    337B

  • MD5

    d90fed2f2872cb0aa450b0a91c5c67e9

  • SHA1

    8af3d7b66b26489fee514b8a6cb3d9b327ce685f

  • SHA256

    23139b2d6e97241d698f684ecf7f8a077aa1206d0d75d1ee6769aac61ebdf4b8

  • SHA512

    ec2819e9e7dfc6da002006661ef794b2a89a2785928336d025c18970929b7e956d56843fa736ab13f9554740b572a4aa2fbe68fabaf3ec472bb7dac3ca02fb65

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\add_acl.ps1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2072-4-0x000000001B3D0000-0x000000001B6B2000-memory.dmp

    Filesize

    2.9MB

  • memory/2072-5-0x0000000002320000-0x0000000002328000-memory.dmp

    Filesize

    32KB

  • memory/2072-6-0x000007FEF62F0000-0x000007FEF6C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2072-7-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2072-8-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2072-9-0x000007FEF62F0000-0x000007FEF6C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2072-10-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2072-11-0x000007FEF62F0000-0x000007FEF6C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2072-12-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2072-14-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2072-13-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2072-16-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2072-17-0x000007FEF62F0000-0x000007FEF6C8D000-memory.dmp

    Filesize

    9.6MB