Analysis
- max time kernel
119s - max time network
153s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
22/12/2023, 13:11
General
- Target 9b34346208a422b5f7ddc652713bd405.ps1
- Size 656KB
- Sample231222-qfc65aeffm
- SHA256 846c3ef5adab25394a7558a2d304c8a50ccef2f6f67485e868868fa481204955
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\9b34346208a422b5f7ddc652713bd405.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2828-4-0x000000001B350000-0x000000001B632000-memory.dmp
memory/2828-6-0x000007FEF61A0000-0x000007FEF6B3D000-memory.dmp
memory/2828-7-0x00000000029F0000-0x0000000002A70000-memory.dmp
memory/2828-5-0x0000000001ED0000-0x0000000001ED8000-memory.dmp
memory/2828-8-0x000007FEF61A0000-0x000007FEF6B3D000-memory.dmp
memory/2828-10-0x00000000029F0000-0x0000000002A70000-memory.dmp
memory/2828-9-0x00000000029F0000-0x0000000002A70000-memory.dmp
memory/2828-11-0x00000000029F0000-0x0000000002A70000-memory.dmp
memory/2828-12-0x00000000029F0000-0x0000000002A70000-memory.dmp
memory/2828-13-0x000007FEF61A0000-0x000007FEF6B3D000-memory.dmp