Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    11/04/2024, 01:08

General

  • Target

    33eae3d42e8abcc05861778c8679759c347a54a3f386b5927afae7538c520472.ps1

  • Size

    1KB

  • MD5

    23fef73a024bf14f093a75a10423c4b7

  • SHA1

    b004fc269a805b62ba8003e4ccd84f07fd154e51

  • SHA256

    33eae3d42e8abcc05861778c8679759c347a54a3f386b5927afae7538c520472

  • SHA512

    9d42b3e14d9cc0b468c292b10685d180e99282daafbbbe38597a789e070ae16d5c4146755ea2c1c6965f9334b8cfad9f0aa9e0309f33f281737096ecc7ab5f7d

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\33eae3d42e8abcc05861778c8679759c347a54a3f386b5927afae7538c520472.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2176

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2176-5-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

          Filesize

          9.6MB

        • memory/2176-9-0x00000000028D0000-0x0000000002950000-memory.dmp

          Filesize

          512KB

        • memory/2176-11-0x00000000028D0000-0x0000000002950000-memory.dmp

          Filesize

          512KB

        • memory/2176-10-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

          Filesize

          9.6MB

        • memory/2176-8-0x00000000028D0000-0x0000000002950000-memory.dmp

          Filesize

          512KB

        • memory/2176-7-0x00000000028D0000-0x0000000002950000-memory.dmp

          Filesize

          512KB

        • memory/2176-6-0x0000000002790000-0x0000000002798000-memory.dmp

          Filesize

          32KB

        • memory/2176-4-0x000000001B5B0000-0x000000001B892000-memory.dmp

          Filesize

          2.9MB

        • memory/2176-12-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

          Filesize

          9.6MB