33eae3d42e8abcc05861778c8679759c347a54a3f386b5927afae7538c520472

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 01:08

Target

33eae3d42e8abcc05861778c8679759c347a54a3f386b5927afae7538c520472.ps1
Size

1KB
MD5

23fef73a024bf14f093a75a10423c4b7
SHA1

b004fc269a805b62ba8003e4ccd84f07fd154e51
SHA256

33eae3d42e8abcc05861778c8679759c347a54a3f386b5927afae7538c520472
SHA512

9d42b3e14d9cc0b468c292b10685d180e99282daafbbbe38597a789e070ae16d5c4146755ea2c1c6965f9334b8cfad9f0aa9e0309f33f281737096ecc7ab5f7d

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	1740	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

flow	ioc
11	discord.com
12	discord.com

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	powershell.exe
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeIncreaseQuotaPrivilege	1740	powershell.exe
Token: SeSecurityPrivilege	1740	powershell.exe
Token: SeTakeOwnershipPrivilege	1740	powershell.exe
Token: SeLoadDriverPrivilege	1740	powershell.exe
Token: SeSystemProfilePrivilege	1740	powershell.exe
Token: SeSystemtimePrivilege	1740	powershell.exe
Token: SeProfSingleProcessPrivilege	1740	powershell.exe
Token: SeIncBasePriorityPrivilege	1740	powershell.exe
Token: SeCreatePagefilePrivilege	1740	powershell.exe
Token: SeBackupPrivilege	1740	powershell.exe
Token: SeRestorePrivilege	1740	powershell.exe
Token: SeShutdownPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeSystemEnvironmentPrivilege	1740	powershell.exe
Token: SeRemoteShutdownPrivilege	1740	powershell.exe
Token: SeUndockPrivilege	1740	powershell.exe
Token: SeManageVolumePrivilege	1740	powershell.exe
Token: 33	1740	powershell.exe
Token: 34	1740	powershell.exe
Token: 35	1740	powershell.exe
Token: 36	1740	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zxgg4mux.dun.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1740-10-0x00007FFCB7800000-0x00007FFCB82C1000-memory.dmp

Filesize
10.8MB

Download
memory/1740-9-0x00000245B0FA0000-0x00000245B0FC2000-memory.dmp

Filesize
136KB

Download
memory/1740-11-0x00000245AE540000-0x00000245AE550000-memory.dmp

Filesize
64KB

Download
memory/1740-12-0x00000245AE540000-0x00000245AE550000-memory.dmp

Filesize
64KB

Download
memory/1740-13-0x00000245AE540000-0x00000245AE550000-memory.dmp

Filesize
64KB

Download
memory/1740-14-0x00000245B1440000-0x00000245B1602000-memory.dmp

Filesize
1.8MB

Download
memory/1740-15-0x00000245B1B40000-0x00000245B2068000-memory.dmp

Filesize
5.2MB

Download
memory/1740-16-0x00000245AE540000-0x00000245AE550000-memory.dmp

Filesize
64KB

Download
memory/1740-19-0x00007FFCB7800000-0x00007FFCB82C1000-memory.dmp

Filesize
10.8MB

Download