Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
03-04-2024 06:39
General
-
Target
SyncBird Pro 4.0.8/SyncBird.app/Contents/Resources/LibraryHolderViewController.nib/keyedobjects.ps1
-
Size
24KB
-
MD5
b122e537a31463b74ee72530e60472cf
-
SHA1
d1c43c4ce1d665f6aa7332f41361576fc656b9d4
-
SHA256
8b46d4e0c8efcf3e620cd52436610a639bc2e70930efe2a15fefce0d980e3bda
-
SHA512
1b867188a8049ff0604c0881dda3767f30e90d0c47d23e4defe64a736a7ba34cc20b077732f37107ed3566934e6184ed811e9bec18f37a9a1c298c694aa48aaa
-
SSDEEP
768:9gGbLNRUYyroY2v5+UMJl0Yyl/SX+s3BD:9ggK65TNI3V
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\SyncBird Pro 4.0.8\SyncBird.app\Contents\Resources\LibraryHolderViewController.nib\keyedobjects.ps1"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2080-4-0x000000001B6B0000-0x000000001B992000-memory.dmpFilesize
2.9MB
-
memory/2080-6-0x00000000029A0000-0x00000000029A8000-memory.dmpFilesize
32KB
-
memory/2080-7-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2080-5-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2080-8-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2080-9-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2080-11-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2080-10-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2080-12-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB