4989b2b14eed528c576634ce1f8a74caa71ae3c67773a1e7758a6ab6f51f5b88

max time kernel
374s
max time network
1579s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28-05-2024 01:50

Sharing

Target

file01 - copia (10) - copia.ps1
Size

462B
MD5

5e2dca825bed214a14705357df13d8d6
SHA1

04f20b1094e5e905bcbcdfc0f1279f6a6e2bbb9e
SHA256

b45546367df23b2459a55ffa753ad4d66f8588263f87c339fb81cde87c3ffba4
SHA512

70a31874a475560704829224c71d6e9f01d6dc3bfe5b1f453ff817753f7a6d1ed51249481cd14e8adae497ad6ddfbe8b4e9556556886dd97c9587b24b0701501

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
2456	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2241qabd.j0s.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/2456-2-0x00007FFE43C83000-0x00007FFE43C84000-memory.dmp

Filesize
4KB

Download
memory/2456-5-0x0000022CF4FF0000-0x0000022CF5012000-memory.dmp

Filesize
136KB

Download
memory/2456-8-0x0000022CF51A0000-0x0000022CF5216000-memory.dmp

Filesize
472KB

Download
memory/2456-9-0x00007FFE43C80000-0x00007FFE4466C000-memory.dmp

Filesize
9.9MB

Download
memory/2456-10-0x00007FFE43C80000-0x00007FFE4466C000-memory.dmp

Filesize
9.9MB

Download
memory/2456-25-0x00007FFE43C80000-0x00007FFE4466C000-memory.dmp

Filesize
9.9MB

Download
memory/2456-46-0x00007FFE43C80000-0x00007FFE4466C000-memory.dmp

Filesize
9.9MB

Download
memory/2456-138-0x00007FFE43C80000-0x00007FFE4466C000-memory.dmp

Filesize
9.9MB

Download
memory/2456-139-0x00007FFE43C80000-0x00007FFE4466C000-memory.dmp

Filesize
9.9MB

Download
memory/2456-140-0x00007FFE43C80000-0x00007FFE4466C000-memory.dmp

Filesize
9.9MB

Download