54b0cd3ee5db8f6574c92e39ac3fcb8be6236f57c82305404ee60b2553c6dbff

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 04:43

Target

666ed175d4a2f463c4df96f78e48adf7.ps1
Size

485KB
MD5

666ed175d4a2f463c4df96f78e48adf7
SHA1

db3b749999695944c0e27c42682a39ee719fac94
SHA256

54b0cd3ee5db8f6574c92e39ac3fcb8be6236f57c82305404ee60b2553c6dbff
SHA512

7148a341f650bd5821abba0a13fce4bd277d17544b61b823c2c2a0ab313825fe56e52b2c968386f2fba97fc1f8cb932bd2d35469e65cd8e03064db917ce8f3bc
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64Eigu:q3Ru

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2088	1976	powershell.exe	29
PID 1976 wrote to memory of 2088	1976	powershell.exe	29
PID 1976 wrote to memory of 2088	1976	powershell.exe	29
PID 1976 wrote to memory of 2088	1976	powershell.exe	29
PID 1976 wrote to memory of 2712	1976	powershell.exe	30
PID 1976 wrote to memory of 2712	1976	powershell.exe	30
PID 1976 wrote to memory of 2712	1976	powershell.exe	30
PID 1976 wrote to memory of 2712	1976	powershell.exe	30
PID 1976 wrote to memory of 2720	1976	powershell.exe	31
PID 1976 wrote to memory of 2720	1976	powershell.exe	31
PID 1976 wrote to memory of 2720	1976	powershell.exe	31
PID 1976 wrote to memory of 2720	1976	powershell.exe	31
PID 1976 wrote to memory of 2816	1976	powershell.exe	32
PID 1976 wrote to memory of 2816	1976	powershell.exe	32
PID 1976 wrote to memory of 2816	1976	powershell.exe	32
PID 1976 wrote to memory of 2816	1976	powershell.exe	32
PID 1976 wrote to memory of 2812	1976	powershell.exe	33
PID 1976 wrote to memory of 2812	1976	powershell.exe	33
PID 1976 wrote to memory of 2812	1976	powershell.exe	33
PID 1976 wrote to memory of 2812	1976	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\666ed175d4a2f463c4df96f78e48adf7.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2812

memory/1976-4-0x000000001B370000-0x000000001B652000-memory.dmp

Filesize
2.9MB

Download
memory/1976-5-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/1976-6-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-7-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/1976-8-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-9-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/1976-10-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/1976-11-0x0000000002A30000-0x0000000002A42000-memory.dmp

Filesize
72KB

Download
memory/1976-12-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download