Analysis

  • max time kernel
    118s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 18:53

General

  • Target

    locales/fa.ps1

  • Size

    557KB

  • MD5

    99de8cfda36ab9ab3342889fb6da393d

  • SHA1

    6bdd3d627d4b6702f43725039089562af58898c0

  • SHA256

    b93145f30e25122015373a248d6ea22a539c7d0d58c8aa853ac35cc80dc06bfe

  • SHA512

    aa20793f9ece5823cb9e74a4a3ff97d7a1860a593f427fb5eacb0390569a48122589610fe5a02577577f3a30f981c5e3da97cf73bdfe158a6bb845586c5b19d6

  • SSDEEP

    12288:WmX9nuyaXTfwI/wNUWGSEfStQvjy1PeZwMTAKzIxRAQiHedNu3htodxWetlClY5f:9uyaXTfwgwNUWGSEfStQvjy1PeZwMTAz

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\fa.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2344

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2344-4-0x000000001B710000-0x000000001B9F2000-memory.dmp

          Filesize

          2.9MB

        • memory/2344-5-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

          Filesize

          32KB

        • memory/2344-6-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

          Filesize

          9.6MB

        • memory/2344-7-0x0000000002D60000-0x0000000002DE0000-memory.dmp

          Filesize

          512KB

        • memory/2344-10-0x0000000002D60000-0x0000000002DE0000-memory.dmp

          Filesize

          512KB

        • memory/2344-9-0x0000000002D60000-0x0000000002DE0000-memory.dmp

          Filesize

          512KB

        • memory/2344-8-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

          Filesize

          9.6MB

        • memory/2344-11-0x0000000002D60000-0x0000000002DE0000-memory.dmp

          Filesize

          512KB

        • memory/2344-12-0x0000000002D60000-0x0000000002DE0000-memory.dmp

          Filesize

          512KB

        • memory/2344-13-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

          Filesize

          9.6MB