Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19-04-2024 07:49
General
-
Target
windows_update/file.ps1
-
Size
13.0MB
-
MD5
20788a06a96ae4d92417ace4661d559a
-
SHA1
239d40f67c27ae2e70c698237a3b27401ef5d37a
-
SHA256
8cc2612a8d44d4aebad26bd6ea254ad25f959497391ccfff127a56fad42eb4d5
-
SHA512
c3bcb3bbf117a933738a85590cf98f0fbd7f995c2b5a559850f089111aac87a774c42110da4237f31bd49a9d7ae2751d77eb3f72aac130c81163c13d58383511
-
SSDEEP
49152:QZuX/CRIRerx1exkxTf0i0vcfo/wFlAPp5Bl0jNlD33oi:
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows_update\file.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2468-4-0x000000001B670000-0x000000001B952000-memory.dmpFilesize
2.9MB
-
memory/2468-5-0x00000000029E0000-0x00000000029E8000-memory.dmpFilesize
32KB
-
memory/2468-6-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmpFilesize
9.6MB
-
memory/2468-7-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/2468-8-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmpFilesize
9.6MB
-
memory/2468-9-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/2468-11-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/2468-10-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/2468-12-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmpFilesize
9.6MB
-
memory/2468-13-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmpFilesize
9.6MB
-
memory/2468-14-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/2468-15-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/2468-16-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB