12bab42e14d5527e12beb088f55bbc190c5e8b12f32239dcce747a1931966652

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wordpress/wp-includes/canonical.ps1
Size

24KB
MD5

7180c5a9cf2b657c71ebce8710dfb788
SHA1

2fd47b82e291fba55ca1ce92b604af3518630d1c
SHA256

36f2b7fd209e794bd026a3b0912125852c7ad79950633033d91dd9b322af1507
SHA512

24e4d56ad01d5d77c2956e744c09f38c51e0353c7c576a0d45a9cca31e4ccd1aa4f53baf255cd47a3f55c79aabfd2c4c33bac84e3d6233f7d84d99063f26b774
SSDEEP

384:+oc4i6LiC1CGHGVyBlkH9JDkD2r0t3Ygpt4DzauuY0m:Y6LiCAGHGVyukqr0t3YgT8zaav

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1488 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1488 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1488 powershell.exe

pid	process
1488	powershell.exe

pid	process
1488	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1488	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wordpress\wp-includes\canonical.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-4-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

Filesize
4KB

Download
memory/1488-5-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/1488-6-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/1488-7-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/1488-8-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/1488-9-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/1488-11-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/1488-10-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/1488-12-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download