9eb716d43c7e136fceac9078a59349c604029821a7f9b62f180ac19a780990fa

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 04:04

Target

2768710190533867f46996fddc060622.ps1
Size

485KB
MD5

2768710190533867f46996fddc060622
SHA1

2d7e320e6e89e349aa490f5514fd622a0440ed3e
SHA256

9eb716d43c7e136fceac9078a59349c604029821a7f9b62f180ac19a780990fa
SHA512

577999277080291215d7a2801f4b1dc909f5d101d5e577a3c473fdc40a9ad8946282959a5be3fa0487efc822172f9fe3d3ed87cc2f06261980890f5818e1fc05
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64sigu:q3Ju

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2792	2724	powershell.exe	28
PID 2724 wrote to memory of 2792	2724	powershell.exe	28
PID 2724 wrote to memory of 2792	2724	powershell.exe	28
PID 2724 wrote to memory of 2792	2724	powershell.exe	28
PID 2724 wrote to memory of 2756	2724	powershell.exe	32
PID 2724 wrote to memory of 2756	2724	powershell.exe	32
PID 2724 wrote to memory of 2756	2724	powershell.exe	32
PID 2724 wrote to memory of 2756	2724	powershell.exe	32
PID 2724 wrote to memory of 2776	2724	powershell.exe	31
PID 2724 wrote to memory of 2776	2724	powershell.exe	31
PID 2724 wrote to memory of 2776	2724	powershell.exe	31
PID 2724 wrote to memory of 2776	2724	powershell.exe	31
PID 2724 wrote to memory of 2696	2724	powershell.exe	30
PID 2724 wrote to memory of 2696	2724	powershell.exe	30
PID 2724 wrote to memory of 2696	2724	powershell.exe	30
PID 2724 wrote to memory of 2696	2724	powershell.exe	30
PID 2724 wrote to memory of 2872	2724	powershell.exe	29
PID 2724 wrote to memory of 2872	2724	powershell.exe	29
PID 2724 wrote to memory of 2872	2724	powershell.exe	29
PID 2724 wrote to memory of 2872	2724	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2768710190533867f46996fddc060622.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2756

memory/2724-5-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

Filesize
9.6MB

Download
memory/2724-4-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/2724-7-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2724-8-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2724-6-0x0000000002730000-0x0000000002738000-memory.dmp

Filesize
32KB

Download
memory/2724-9-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2724-10-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

Filesize
9.6MB

Download
memory/2724-11-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2724-12-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/2724-13-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

Filesize
9.6MB

Download