87dc8a31b38e584652dbbea9996dcbff96599dac087b5b48d74b02f4af9b0d86

Analysis

max time kernel
36s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 11:23

Target

$INTERNET_CACHE/Classical.ps1
Size

235KB
MD5

eaf385cdf1314e338da96bb238f75b01
SHA1

2d6c7d5e4564e782bba21fea45669be4caf2fa96
SHA256

bad782e8dd1a95af87f67c7dcc036d62d3bbc8a47fa3384ce9883eb2f36ecca1
SHA512

41b9d8096870dcaa51fba676238297a12c46cfe3a6ab2f84f95b10b606b7ae56775c40ab75df268f0fb3795fe82a9fb3e668069de4142f04b9191d947dc4c3fd
SSDEEP

3072:dHemsIqQVUHwtwP9Xzm9onM/0UeXprNWRz9onM/0UrhkcjGjyiIZyxiY/1H3uGzo:Bgc4iwHF8gETgEX+Y

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

5080 powershell.exe
5080 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5080 powershell.exe

pid	process
5080	powershell.exe
5080	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5080	powershell.exe

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_23cbc5uo.hav.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/5080-5-0x0000024EBD780000-0x0000024EBD7A2000-memory.dmp

Filesize
136KB

Download
memory/5080-10-0x00007FFF05A10000-0x00007FFF064D1000-memory.dmp

Filesize
10.8MB

Download
memory/5080-11-0x0000024EBD7E0000-0x0000024EBD7F0000-memory.dmp

Filesize
64KB

Download
memory/5080-12-0x0000024EBD7E0000-0x0000024EBD7F0000-memory.dmp

Filesize
64KB

Download
memory/5080-15-0x00007FFF05A10000-0x00007FFF064D1000-memory.dmp

Filesize
10.8MB

Download