Resubmissions
15/04/2024, 17:37
240415-v66nksed8w 715/04/2024, 17:34
240415-v5ll1sed3z 715/04/2024, 17:30
240415-v3fmzsca66 315/04/2024, 17:27
240415-v1vdcseb8w 7Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/04/2024, 17:30
General
-
Target
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/en-US/M.ps1
-
Size
3KB
-
MD5
a709c70bbf5b48f47a2d985bb045e381
-
SHA1
888f8a986eb2929ab715f2439cc753740051d94a
-
SHA256
20f8b0b178efd4b32af4697d88fc20dcd2efcbd17ac6321488c3b860f1c60230
-
SHA512
3deb3604f8336d59d84096a76cb7c440f42aee288c7c9410bafd5d997c2f85781cc78051a173c628481a7f45673bbb49da77e820ba0b9942169d428f9c28759d
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\M.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB