Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/03/2024, 21:28
General
- Target locales/uk.ps1
- Size 657KB
- Sample240302-1bdbfahf5y
- SHA256 bd02966f6c6258b66eae7ff014710925e53fe26e8254d7db4e9147266025cc3a
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x314 0x40c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_y0soquht.2y5.ps1
memory/4556-0-0x000002AB4D680000-0x000002AB4D6A2000-memory.dmp
memory/4556-10-0x00007FFEF6EC0000-0x00007FFEF7981000-memory.dmp
memory/4556-11-0x000002AB4D670000-0x000002AB4D680000-memory.dmp
memory/4556-12-0x000002AB4D670000-0x000002AB4D680000-memory.dmp
memory/4556-15-0x00007FFEF6EC0000-0x00007FFEF7981000-memory.dmp