Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
20-04-2024 06:27
General
-
Target
DiagReport.ps1
-
Size
8KB
-
MD5
7457f5e88035d91752f988df57aa0689
-
SHA1
8cbd43f00fdc2ae2b0ac7429454eb7708031ee70
-
SHA256
4180f15d32e84d1f3ed1c256bdc86f73d96e6615b3a10bf67bfc50c30a9912ed
-
SHA512
2ccfe0eb0724461fc123f9693724386426497ed7236a5180475223528610216dab9f5b4d61a53dc6882322aec3414b7b9a1c39d651a6a289ba40e29d51575916
-
SSDEEP
96:4g+14dBdsaHQCMMavbtBG7IYMGOUU+Sz1ROVP7BNE9dn:4x4dBdsaHQZMay6W1X3Kh
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\DiagReport.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\DiagReport-20240420-062738.txt2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD52749c7057ccd036cf213777e17c0475d
SHA19ee3fd87fb31fea0950e9d6095f41c6d991b6184
SHA256632e506e5dd75fc75c012e75785da2a62a2f407e96c285d7dd08f3963473fa64
SHA5126edc0322378138b326cadf22fe90b4cfa396f351b2a08155ed63fecd3683684c3aa5326c4a33850bc6b006a7db9b630285e40e27901fda2cc41ebcc9d32e04a2
-
Filesize
9.6MB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB