c96c0efc04c9bc99c2b472362d81e61511d9bf28f472ee92d8b9ea8a15f4e470

Analysis

max time kernel
114s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 11:53

Target

atspcleannew.ps1
Size

2KB
MD5

f53d227d03315910a72da97d4fc774d5
SHA1

cdd5e7ae4c20b2e5e746edf863e557c419bbae59
SHA256

c96c0efc04c9bc99c2b472362d81e61511d9bf28f472ee92d8b9ea8a15f4e470
SHA512

aac5927f9bbb00a7d6539cf3e966303b501d29d280c266386c3a5dcedc638e17da96024310e6b0c20a5a5ffd03521ea0e4728a62b712004667c4f9d8504f77ac

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	powershell.exe
3152	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeIncreaseQuotaPrivilege	3152	powershell.exe
Token: SeSecurityPrivilege	3152	powershell.exe
Token: SeTakeOwnershipPrivilege	3152	powershell.exe
Token: SeLoadDriverPrivilege	3152	powershell.exe
Token: SeSystemProfilePrivilege	3152	powershell.exe
Token: SeSystemtimePrivilege	3152	powershell.exe
Token: SeProfSingleProcessPrivilege	3152	powershell.exe
Token: SeIncBasePriorityPrivilege	3152	powershell.exe
Token: SeCreatePagefilePrivilege	3152	powershell.exe
Token: SeBackupPrivilege	3152	powershell.exe
Token: SeRestorePrivilege	3152	powershell.exe
Token: SeShutdownPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeSystemEnvironmentPrivilege	3152	powershell.exe
Token: SeRemoteShutdownPrivilege	3152	powershell.exe
Token: SeUndockPrivilege	3152	powershell.exe
Token: SeManageVolumePrivilege	3152	powershell.exe
Token: 33	3152	powershell.exe
Token: 34	3152	powershell.exe
Token: 35	3152	powershell.exe
Token: 36	3152	powershell.exe

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_evaq0b5b.sbt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3152-9-0x0000020735290000-0x00000207352B2000-memory.dmp

Filesize
136KB

Download
memory/3152-10-0x00007FFDA5D70000-0x00007FFDA6831000-memory.dmp

Filesize
10.8MB

Download
memory/3152-11-0x000002074D710000-0x000002074D720000-memory.dmp

Filesize
64KB

Download
memory/3152-12-0x000002074D710000-0x000002074D720000-memory.dmp

Filesize
64KB

Download
memory/3152-13-0x00000207352C0000-0x00000207352CE000-memory.dmp

Filesize
56KB

Download
memory/3152-14-0x000002074D6D0000-0x000002074D6EA000-memory.dmp

Filesize
104KB

Download
memory/3152-15-0x000002074D710000-0x000002074D720000-memory.dmp

Filesize
64KB

Download
memory/3152-18-0x00007FFDA5D70000-0x00007FFDA6831000-memory.dmp

Filesize
10.8MB

Download