Analysis

  • max time kernel
    122s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04-02-2024 17:54

General

  • Target

    wordpress/wp-admin/includes/class-core-upgrader.ps1

  • Size

    14KB

  • MD5

    4097fae4351cc9f517938db0d5aa847a

  • SHA1

    4e714e18c9a50fa7ae8406090161b22498a1b53f

  • SHA256

    cda2a0f071d3fe710e0071acc5351bb4f9497a818436a87698fc5ea00eb50eb2

  • SHA512

    e7db1a3b226c6e3a223ca984756b75af252c9dae30e79faa8cd3d73704df436e3b2974ef4bdb9dc59f0230ec3e30b2b7292cdd99bb780a7df607150a7643e7f9

  • SSDEEP

    384:7zqcqG+B2xDayguDNt8sBLXkcRgOkhONNVDUPpj+DQU3jSXGpCm5K+RgVclSK:7+HG+IxeahtVBLXZRgOkhOPVyj+UcjSq

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wordpress\wp-admin\includes\class-core-upgrader.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2700-4-0x000000001B140000-0x000000001B422000-memory.dmp

    Filesize

    2.9MB

  • memory/2700-5-0x0000000002560000-0x0000000002568000-memory.dmp

    Filesize

    32KB

  • memory/2700-6-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

    Filesize

    9.6MB

  • memory/2700-9-0x0000000002850000-0x00000000028D0000-memory.dmp

    Filesize

    512KB

  • memory/2700-8-0x0000000002850000-0x00000000028D0000-memory.dmp

    Filesize

    512KB

  • memory/2700-7-0x0000000002850000-0x00000000028D0000-memory.dmp

    Filesize

    512KB

  • memory/2700-10-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

    Filesize

    9.6MB

  • memory/2700-11-0x0000000002850000-0x00000000028D0000-memory.dmp

    Filesize

    512KB

  • memory/2700-12-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

    Filesize

    9.6MB