ea0157bc1e7b2178b75854a5fa5f139e4b94da24fdfb6710b69bc0318c25a379

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 23:45

Target

8ad68f5c7dd4d299af03f3a53d3eea8f.ps1
Size

485KB
MD5

8ad68f5c7dd4d299af03f3a53d3eea8f
SHA1

16413b33f91a5ac23b9afdce7b639aa5749b2a06
SHA256

ea0157bc1e7b2178b75854a5fa5f139e4b94da24fdfb6710b69bc0318c25a379
SHA512

774e43244601d378ae81cb332ab464b4ff19bb4d4441910eab59a5b83dde15fa27712a339ac7e7517e9345fab5948188c5b1071ef46ce2bd91313aee6f9c2297
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64Migu:q3Fu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2848	1444	powershell.exe	29
PID 1444 wrote to memory of 2848	1444	powershell.exe	29
PID 1444 wrote to memory of 2848	1444	powershell.exe	29
PID 1444 wrote to memory of 2848	1444	powershell.exe	29
PID 1444 wrote to memory of 2880	1444	powershell.exe	30
PID 1444 wrote to memory of 2880	1444	powershell.exe	30
PID 1444 wrote to memory of 2880	1444	powershell.exe	30
PID 1444 wrote to memory of 2880	1444	powershell.exe	30
PID 1444 wrote to memory of 3004	1444	powershell.exe	31
PID 1444 wrote to memory of 3004	1444	powershell.exe	31
PID 1444 wrote to memory of 3004	1444	powershell.exe	31
PID 1444 wrote to memory of 3004	1444	powershell.exe	31
PID 1444 wrote to memory of 2760	1444	powershell.exe	32
PID 1444 wrote to memory of 2760	1444	powershell.exe	32
PID 1444 wrote to memory of 2760	1444	powershell.exe	32
PID 1444 wrote to memory of 2760	1444	powershell.exe	32
PID 1444 wrote to memory of 2752	1444	powershell.exe	33
PID 1444 wrote to memory of 2752	1444	powershell.exe	33
PID 1444 wrote to memory of 2752	1444	powershell.exe	33
PID 1444 wrote to memory of 2752	1444	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8ad68f5c7dd4d299af03f3a53d3eea8f.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2752

memory/1444-5-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1444-4-0x000000001B240000-0x000000001B522000-memory.dmp

Filesize
2.9MB

Download
memory/1444-7-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1444-6-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/1444-8-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1444-9-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1444-10-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1444-11-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1444-12-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/1444-13-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download