Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-02-2024 17:42

General

  • Target

    JUDICIAL LETTER...ps1

  • Size

    359KB

  • MD5

    abe7d5c1f807a15a46f57fb3f318efeb

  • SHA1

    549309c316e9a53777e2a8fbc35711598e86bfa4

  • SHA256

    736598f704c00648dfa3bd71f8432a7ee729b1948959588c63f9317b659425f2

  • SHA512

    00e2870d78f5e25e82fbcd52064d5db9c0bc7e9ac6298a3cfa45c965e1d73334c84d390a33183e56048b5189d05611d461c7f998eb4cd8033136316e0fbe3e13

  • SSDEEP

    6144:z8MUJJ7b77MKQGZNUfOUYdxhkLEbfWrCDFdashOxPSzBiOmWqO8QVl1RfuJX/imA:z8xLPgKHHUsqroFd57zUOFQIlD2JX/iP

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\JUDICIAL LETTER...ps1"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1940-4-0x000000001B4A0000-0x000000001B782000-memory.dmp

    Filesize

    2.9MB

  • memory/1940-6-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp

    Filesize

    9.6MB

  • memory/1940-5-0x0000000002890000-0x0000000002898000-memory.dmp

    Filesize

    32KB

  • memory/1940-7-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/1940-8-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp

    Filesize

    9.6MB

  • memory/1940-9-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/1940-10-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/1940-11-0x00000000027E0000-0x0000000002860000-memory.dmp

    Filesize

    512KB

  • memory/1940-12-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp

    Filesize

    9.6MB