d1902d3e519d0d87097fd8969280bd01bd139a5191faadaed0149e61b4a7495c

max time kernel
2s
max time network
0s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 16:23

Sharing

Target

file01.ps1
Size

510B
MD5

2dcb4d51653aec1a829f3232d69f5e12
SHA1

dd096e7d800b9f3ca0edc64955b4464d71789f80
SHA256

d1902d3e519d0d87097fd8969280bd01bd139a5191faadaed0149e61b4a7495c
SHA512

7def3731bbb3f7ac3895edcf14c645bbcc0608f09c6b03bf7ddaebf049f1f6f1aad4086548ab9fce7b2bbefd837de8377f8b81cf94022d84e35f1bba0af89143

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
2840	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2840-4-0x000007FEF5F2E000-0x000007FEF5F2F000-memory.dmp

Filesize
4KB

Download
memory/2840-5-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2840-6-0x0000000001F60000-0x0000000001F68000-memory.dmp

Filesize
32KB

Download
memory/2840-7-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-8-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-9-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-10-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download