Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 09:56

General

  • Target

    7cd1ab665153f1c565101cbacb411157755275462c610b5356753e22963c495d.ps1

  • Size

    3KB

  • MD5

    1a7f027d6059e120c38ffac4b44c9264

  • SHA1

    f1c8fc2a7101981cfe1a241b58be414f0b8bd4db

  • SHA256

    7cd1ab665153f1c565101cbacb411157755275462c610b5356753e22963c495d

  • SHA512

    fdf6cf398f149c53f3ab556f1ada9cc8a31012ea4a8d791758af77fb82a0707c7e6326c7b53199b730952b52e472331c107eddafccd9a95dc131a6e91d311919

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\7cd1ab665153f1c565101cbacb411157755275462c610b5356753e22963c495d.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2968

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2968-4-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

          Filesize

          2.9MB

        • memory/2968-5-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

          Filesize

          9.6MB

        • memory/2968-6-0x0000000002760000-0x0000000002768000-memory.dmp

          Filesize

          32KB

        • memory/2968-7-0x0000000002B60000-0x0000000002BE0000-memory.dmp

          Filesize

          512KB

        • memory/2968-8-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

          Filesize

          9.6MB

        • memory/2968-9-0x0000000002B60000-0x0000000002BE0000-memory.dmp

          Filesize

          512KB

        • memory/2968-10-0x0000000002B60000-0x0000000002BE0000-memory.dmp

          Filesize

          512KB

        • memory/2968-11-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

          Filesize

          9.6MB