Overview

overview

1

Static

static

1

451a4cbb6b...57.ps1

windows7-x64

1

451a4cbb6b...57.ps1

windows10-2004-x64

1

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 10:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    451a4cbb6b931d8bb8392f08e7c9ec517b1b1ef06f42e1c8105e4feaafd6b157.ps1

  • Size

    14KB

  • MD5

    abcfb2660a661a8c0bc4db1417361dd7

  • SHA1

    6ad3b3d768526e3e43ad01dbb40d24e235dead2d

  • SHA256

    451a4cbb6b931d8bb8392f08e7c9ec517b1b1ef06f42e1c8105e4feaafd6b157

  • SHA512

    b05c19c865a2f2dcc8b8299e53bc60a408e57b57405238d6972e8aa44af5d4625d4276af125d86de04a3865aab2f727f855ea4b3827eb838b28775e794913271

  • SSDEEP

    192:yzpnYr1O7OHrlvUrGfEF91p/a1gHBiGrauLHj36nl1JodLhLla2DPqccyqWnSiE:cV6hUrGfECESSwqtla2Dy1yqWnSX

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\451a4cbb6b931d8bb8392f08e7c9ec517b1b1ef06f42e1c8105e4feaafd6b157.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2076

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2076-4-0x000000001B180000-0x000000001B462000-memory.dmp

          Filesize

          2.9MB

          Download

        • memory/2076-5-0x0000000002040000-0x0000000002048000-memory.dmp

          Filesize

          32KB

          Download

        • memory/2076-6-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/2076-7-0x0000000002880000-0x0000000002900000-memory.dmp

          Filesize

          512KB

          Download

        • memory/2076-8-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/2076-9-0x0000000002880000-0x0000000002900000-memory.dmp

          Filesize

          512KB

          Download

        • memory/2076-10-0x0000000002880000-0x0000000002900000-memory.dmp

          Filesize

          512KB

          Download

        • memory/2076-11-0x0000000002880000-0x0000000002900000-memory.dmp

          Filesize

          512KB

          Download

        • memory/2076-12-0x0000000002880000-0x0000000002900000-memory.dmp

          Filesize

          512KB

          Download

        • memory/2076-13-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

          Filesize

          9.6MB

          Download