Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 11:10
Static task
static1
Behavioral task
behavioral1
Sample
big.ps1
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
big.ps1
Resource
win10v2004-20240412-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
big.ps1
-
Size
11.2MB
-
MD5
cbf8ae11065184964e7ee9533836c668
-
SHA1
34047bde03d2615d876d21106538e27132c81ae6
-
SHA256
791722d558475d9ed6219a5b22c6cb2df2a18928a5cc5b7b341f59fc024093c9
-
SHA512
a5e9b59a00327f0da6006f43edff006caf26271f7d25a1bcc094bc9d94db9da63fc6fbe26183a1745acf6e2fe86b1f600725c7f3677a06bcc7d12e216e764b40
-
SSDEEP
49152:/H+uozbw6H4JCHhy2rc70OvlOXFSP7gVf:2
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 824 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 824 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/824-4-0x000000001B5B0000-0x000000001B892000-memory.dmpFilesize
2.9MB
-
memory/824-6-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmpFilesize
9.6MB
-
memory/824-5-0x0000000002820000-0x0000000002828000-memory.dmpFilesize
32KB
-
memory/824-7-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/824-8-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmpFilesize
9.6MB
-
memory/824-9-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/824-10-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/824-11-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/824-12-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmpFilesize
9.6MB
-
memory/824-13-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmpFilesize
9.6MB
-
memory/824-14-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/824-15-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/824-16-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB