a22f393576c3c8fa3ade88102fa98dfc93097d15b4c453ef676f6daaefffa592

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoSettings/Files/Tools/ViewMyDisks.ps1
Size

3KB
MD5

3b81e3c5e23b7c2a24f6a4e938af78ab
SHA1

3330f35cfb49fc53426e21dd26d35488fd25c4e1
SHA256

b7e9b7e96781ec848b396c60e21ebe7f8d27a69e62ffff179fceeadcd0096ee5
SHA512

96853b807d6d971f0e327257951d0773a7f3beb5f43b820d31cac419dad02eb08d941067b10664e7d9cf36346a734457f64bc35538357a9438b02733debfa3c0

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2544	powershell.exe
2544	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeIncreaseQuotaPrivilege	2544	powershell.exe
Token: SeSecurityPrivilege	2544	powershell.exe
Token: SeTakeOwnershipPrivilege	2544	powershell.exe
Token: SeLoadDriverPrivilege	2544	powershell.exe
Token: SeSystemProfilePrivilege	2544	powershell.exe
Token: SeSystemtimePrivilege	2544	powershell.exe
Token: SeProfSingleProcessPrivilege	2544	powershell.exe
Token: SeIncBasePriorityPrivilege	2544	powershell.exe
Token: SeCreatePagefilePrivilege	2544	powershell.exe
Token: SeBackupPrivilege	2544	powershell.exe
Token: SeRestorePrivilege	2544	powershell.exe
Token: SeShutdownPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeSystemEnvironmentPrivilege	2544	powershell.exe
Token: SeRemoteShutdownPrivilege	2544	powershell.exe
Token: SeUndockPrivilege	2544	powershell.exe
Token: SeManageVolumePrivilege	2544	powershell.exe
Token: 33	2544	powershell.exe
Token: 34	2544	powershell.exe
Token: 35	2544	powershell.exe
Token: 36	2544	powershell.exe
Token: SeIncreaseQuotaPrivilege	2544	powershell.exe
Token: SeSecurityPrivilege	2544	powershell.exe
Token: SeTakeOwnershipPrivilege	2544	powershell.exe
Token: SeLoadDriverPrivilege	2544	powershell.exe
Token: SeSystemProfilePrivilege	2544	powershell.exe
Token: SeSystemtimePrivilege	2544	powershell.exe
Token: SeProfSingleProcessPrivilege	2544	powershell.exe
Token: SeIncBasePriorityPrivilege	2544	powershell.exe
Token: SeCreatePagefilePrivilege	2544	powershell.exe
Token: SeBackupPrivilege	2544	powershell.exe
Token: SeRestorePrivilege	2544	powershell.exe
Token: SeShutdownPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeSystemEnvironmentPrivilege	2544	powershell.exe
Token: SeRemoteShutdownPrivilege	2544	powershell.exe
Token: SeUndockPrivilege	2544	powershell.exe
Token: SeManageVolumePrivilege	2544	powershell.exe
Token: 33	2544	powershell.exe
Token: 34	2544	powershell.exe
Token: 35	2544	powershell.exe
Token: 36	2544	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\AutoSettings\Files\Tools\ViewMyDisks.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_morzlzjh.aps.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2544-0-0x000001F7FC880000-0x000001F7FC8A2000-memory.dmp

Filesize
136KB

Download
memory/2544-12-0x000001F7FE910000-0x000001F7FE920000-memory.dmp

Filesize
64KB

Download
memory/2544-11-0x000001F7FE910000-0x000001F7FE920000-memory.dmp

Filesize
64KB

Download
memory/2544-10-0x00007FF8C5710000-0x00007FF8C61D1000-memory.dmp

Filesize
10.8MB

Download
memory/2544-14-0x000001F7FE170000-0x000001F7FE194000-memory.dmp

Filesize
144KB

Download
memory/2544-13-0x000001F7FE170000-0x000001F7FE19A000-memory.dmp

Filesize
168KB

Download
memory/2544-15-0x000001F7FE910000-0x000001F7FE920000-memory.dmp

Filesize
64KB

Download
memory/2544-16-0x000001F7FE910000-0x000001F7FE920000-memory.dmp

Filesize
64KB

Download
memory/2544-20-0x00007FF8C5710000-0x00007FF8C61D1000-memory.dmp

Filesize
10.8MB

Download