Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2023 22:05

General

  • Target

    b148c2726f08d1f74516ee69d181aced.ps1

  • Size

    9KB

  • MD5

    b148c2726f08d1f74516ee69d181aced

  • SHA1

    895fbad577d560db08fd2188a201be588f99e86f

  • SHA256

    70cd06e32e96f29930a42ff6755b67147fde9aab490dc0248a60bcec8ad3ad99

  • SHA512

    6f3148f46ba7c5ed492a7bc3e9c3860a5d33675e7277011f477f38ae8819349f039471efb7b093fd774b1122bc7e6bdfcdc290fce4a1b2b6a17323f4abd1d37f

  • SSDEEP

    96:g2+dz8qVsVulmO7UIO1mWO7UI3myA2+rz42+Jz2CHDuCXDWVsaK1BMFTdWGqvwmJ:IWAmVGyGHqqwrkxdtY97iFlhYt44i3N

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b148c2726f08d1f74516ee69d181aced.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2468-4-0x000000001B710000-0x000000001B9F2000-memory.dmp

    Filesize

    2.9MB

  • memory/2468-5-0x0000000002860000-0x0000000002868000-memory.dmp

    Filesize

    32KB

  • memory/2468-6-0x000007FEF60C0000-0x000007FEF6A5D000-memory.dmp

    Filesize

    9.6MB

  • memory/2468-7-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/2468-10-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/2468-9-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/2468-8-0x000007FEF60C0000-0x000007FEF6A5D000-memory.dmp

    Filesize

    9.6MB

  • memory/2468-11-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/2468-12-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/2468-13-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/2468-14-0x000007FEF60C0000-0x000007FEF6A5D000-memory.dmp

    Filesize

    9.6MB