Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 11:41
Static task
static1
Behavioral task
behavioral1
Sample
fchar256.ps1
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
fchar256.ps1
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
fchar256.ps1
-
Size
2KB
-
MD5
1ea923f76f3365bda6a8d19aeb0627f8
-
SHA1
7a05b6f1c8d7534d0578904103c1b80c550dc667
-
SHA256
7a69fe31080b9ca6c4c9b47a534a8fcf2cc87a0707943046bfdae4a08f251984
-
SHA512
938f97c189375a95145f85132720e5dbf55b72f3609f432fe0ef8921dd700d4ea23e17b0794ee7d538616da78d388769e997d5c4f5206ced146cef0519b6d0a6
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 2 2760 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2760 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fchar256.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2760-4-0x000007FEF5D5E000-0x000007FEF5D5F000-memory.dmpFilesize
4KB
-
memory/2760-5-0x000000001B5D0000-0x000000001B8B2000-memory.dmpFilesize
2.9MB
-
memory/2760-7-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmpFilesize
9.6MB
-
memory/2760-9-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmpFilesize
9.6MB
-
memory/2760-10-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmpFilesize
9.6MB
-
memory/2760-8-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmpFilesize
9.6MB
-
memory/2760-6-0x0000000001E70000-0x0000000001E78000-memory.dmpFilesize
32KB
-
memory/2760-11-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmpFilesize
9.6MB
-
memory/2760-12-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmpFilesize
9.6MB