Analysis
- max time kernel
123s - max time network
141s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
02/03/2024, 22:42
General
- Target locales/de.ps1
- Size 477KB
- Sample240302-2mxpwsae65
- SHA256 163ea4c2cf67edd0526a8e18d3810872e92a1d4e17b5cf4f04107fda5967b0c9
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\de.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jhwwhume.t0n.ps1
memory/3412-4-0x00007FFD8AC60000-0x00007FFD8B64C000-memory.dmp
memory/3412-6-0x000001FBF5940000-0x000001FBF5950000-memory.dmp
memory/3412-5-0x000001FBF5E60000-0x000001FBF5E82000-memory.dmp
memory/3412-7-0x000001FBF5940000-0x000001FBF5950000-memory.dmp
memory/3412-10-0x000001FBF6010000-0x000001FBF6086000-memory.dmp
memory/3412-33-0x000001FBF5940000-0x000001FBF5950000-memory.dmp
memory/3412-34-0x00007FFD8AC60000-0x00007FFD8B64C000-memory.dmp
memory/3412-35-0x000001FBF5940000-0x000001FBF5950000-memory.dmp