Analysis
-
max time kernel
1558s -
max time network
1559s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
18/01/2024, 16:41
General
-
Target
bshdbfhsbdf.ps1
-
Size
10.7MB
-
MD5
d2e94853c5b4c54f6a8f7c172315f7e8
-
SHA1
92603972db4d1be6b30bd0e5122a1be6e23df726
-
SHA256
a3973bd0bad3dc5e078ed58ad11948a1e31fc45aeaf2d3904d1cfbb5ebaedb37
-
SHA512
d503f25abf52fa94d0a98bf0c43ffcf951fcbcf4fc35542530f600e863fd52da5a92f42ba4de19f9bf2f0ee996f51e0690e8b49853e329aa5931cafe1c76258b
-
SSDEEP
12288:Bbs8/d+6iwu77Ply9QxRmKoESXTE/lyKmyEWfHUNiUoheOo:/
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bshdbfhsbdf.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -NoLogo -NonInteractive -NoProfile -w h -f "C:\Users\Admin\AppData\Local\Temp\bshdbfhsbdf.ps1" -usradm 12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD509fb2010b8db09bf12f0019ef1144fc8
SHA1c45926d6dc5bfd5486435b50a41aa60bbbe62eb5
SHA25615a80895f35892be4793f902f11dc17194e2dbc50064a7f3239787efa8bbfce4
SHA5123d22d5bea18cf7c888187dadeee6c259d133c426b3448772876c4a01388f9b913f3057e5edd01766dddcf09f907a86dc65ceffb8177780b908dbb65888cbdadb
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
12KB