39a1875ed04d3008b0e88b3dc060881979662f793e6676e8f9510e07e735ed4d

Analysis

max time kernel
138s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 19:30

Target

code.ps1
Size

163B
MD5

764bda7cdcc570aaeb1b1442b55e9637
SHA1

0e189645145a6dcb08e0603bdb48b12ed61a108e
SHA256

39a1875ed04d3008b0e88b3dc060881979662f793e6676e8f9510e07e735ed4d
SHA512

33897a2483348f2632d9d5b2f13e2c076edbe078902329c5b2d9e8866a3b61489d1da3104953ae3954b0561ebbb2c7cba8421deddab2debebd5b4c3e80cdf4cb

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeIncreaseQuotaPrivilege	2512	powershell.exe
Token: SeSecurityPrivilege	2512	powershell.exe
Token: SeTakeOwnershipPrivilege	2512	powershell.exe
Token: SeLoadDriverPrivilege	2512	powershell.exe
Token: SeSystemProfilePrivilege	2512	powershell.exe
Token: SeSystemtimePrivilege	2512	powershell.exe
Token: SeProfSingleProcessPrivilege	2512	powershell.exe
Token: SeIncBasePriorityPrivilege	2512	powershell.exe
Token: SeCreatePagefilePrivilege	2512	powershell.exe
Token: SeBackupPrivilege	2512	powershell.exe
Token: SeRestorePrivilege	2512	powershell.exe
Token: SeShutdownPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeSystemEnvironmentPrivilege	2512	powershell.exe
Token: SeRemoteShutdownPrivilege	2512	powershell.exe
Token: SeUndockPrivilege	2512	powershell.exe
Token: SeManageVolumePrivilege	2512	powershell.exe
Token: 33	2512	powershell.exe
Token: 34	2512	powershell.exe
Token: 35	2512	powershell.exe
Token: 36	2512	powershell.exe

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1wzmczqq.ch3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2512-5-0x000001A579D20000-0x000001A579D42000-memory.dmp

Filesize
136KB

Download
memory/2512-12-0x000001A57A220000-0x000001A57A230000-memory.dmp

Filesize
64KB

Download
memory/2512-11-0x000001A57A220000-0x000001A57A230000-memory.dmp

Filesize
64KB

Download
memory/2512-10-0x00007FFC734D0000-0x00007FFC73F91000-memory.dmp

Filesize
10.8MB

Download
memory/2512-13-0x000001A57A220000-0x000001A57A230000-memory.dmp

Filesize
64KB

Download
memory/2512-14-0x000001A57A220000-0x000001A57A230000-memory.dmp

Filesize
64KB

Download
memory/2512-17-0x00007FFC734D0000-0x00007FFC73F91000-memory.dmp

Filesize
10.8MB

Download