Overview

overview

10

Static

static

1

13032024_1...te.ps1

windows7-x64

1

13032024_1...te.ps1

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-03-2024 09:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    13032024_1705_update.ps1

  • Size

    13.0MB

  • MD5

    ffb99e756878951810566df652349d8f

  • SHA1

    bc651703216d0e6bf1d13e3c8387defebfadc00c

  • SHA256

    3c9bf0c7215cf48ec6dee4d5453335dee2fc40b629f30fe19e8433099dc793f2

  • SHA512

    3bb146d8ba6b0f20522d0fb6acc95db4bb417388f8ee420eeee934006cf2903a46ac59c62386cd1dbf6f0bc12e6b18836c2e5d590470b70b505acd669e148952

  • SSDEEP

    24576:rsbvdH27nGZlkWYoaFyTQ+rByBDGj8tbW2XfFBdg/qf35jeAwXsxMijIvqcEfxhU:PjxLsoaw0De0tdrL3nF4sEz8bXX

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\13032024_1705_update.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1940-4-0x000000001B6D0000-0x000000001B9B2000-memory.dmp
    Filesize

    2.9MB

    Download
  • memory/1940-5-0x0000000002720000-0x0000000002728000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1940-6-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/1940-7-0x0000000002A40000-0x0000000002AC0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1940-8-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/1940-9-0x0000000002A40000-0x0000000002AC0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1940-10-0x0000000002A40000-0x0000000002AC0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1940-11-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/1940-12-0x0000000002A40000-0x0000000002AC0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1940-13-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/1940-14-0x0000000002A40000-0x0000000002AC0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1940-15-0x0000000002A40000-0x0000000002AC0000-memory.dmp
    Filesize

    512KB

    Download