Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2024 11:13

General

  • Target

    var/www/html/admin/admin_filecheck.ps1

  • Size

    2KB

  • MD5

    88ab93f50f3bdaaa8370bcb2dc66d761

  • SHA1

    1fc3c4f7e6e40ad2fe98d0fb05758517aacb84cc

  • SHA256

    4a1002c959d2f7e4b425f74d6ed2d7a82546e3307e8bbe2d8c742541468550fd

  • SHA512

    f96d6075f55737c45d708fdfcc7d2a0a1c08f5a835c53c57d5ba43592a189e9506a5e8d3070e20f4f9ab1485efd76102f81efa2ae8e65a86820556d8396ea234

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\var\www\html\admin\admin_filecheck.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2680-4-0x000000001B440000-0x000000001B722000-memory.dmp

    Filesize

    2.9MB

  • memory/2680-6-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

    Filesize

    9.6MB

  • memory/2680-5-0x0000000002560000-0x0000000002568000-memory.dmp

    Filesize

    32KB

  • memory/2680-7-0x0000000002AF0000-0x0000000002B70000-memory.dmp

    Filesize

    512KB

  • memory/2680-8-0x0000000002AF0000-0x0000000002B70000-memory.dmp

    Filesize

    512KB

  • memory/2680-9-0x0000000002AF0000-0x0000000002B70000-memory.dmp

    Filesize

    512KB

  • memory/2680-10-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

    Filesize

    9.6MB

  • memory/2680-11-0x000007FEF5E00000-0x000007FEF679D000-memory.dmp

    Filesize

    9.6MB

  • memory/2680-12-0x0000000002AF0000-0x0000000002B70000-memory.dmp

    Filesize

    512KB