Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/03/2024, 21:59
General
-
Target
$TEMP/Omissions.ps1
-
Size
163KB
-
MD5
ce6aab10736655fe51357ef763a81873
-
SHA1
00cc63e8c40ccde40537e7c80c565660ff681530
-
SHA256
dd2b0347be3f0535db49269d8ae57af1024235aed4d9d258499fd0404d3c1f08
-
SHA512
7938c7b8cbae3c1b6a0c8b7dc8005b1d7385177ba018685372b5919f2c86184d7ceb6e0cf5ed8d28fef16f4bf9bdf9015dd9767842822c085a9502783b6bd73f
-
SSDEEP
1536:iuEDz3qOqC1/i8aLglZWI3e79rcpFex9enOtM6HgSrpghxihKz0nYGjRjyfp/p6s:C6cwFD5WYudjmQ
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$TEMP\Omissions.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB