Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 11:15

General

  • Target

    mig/dist/Minecraft code gen/_internal/tcl/http1.0/http.ps1

  • Size

    9KB

  • MD5

    c2092f8ca2d761dfa8c461076d956374

  • SHA1

    90b4648b3bc81c30465b0be83a5db4127a1392fb

  • SHA256

    8c474095a3aba7df5b488f3d35240d6de729e57153980c2a898728b8c407a727

  • SHA512

    09ce408886e2ceaddf70786a15d63af9a930e70cac4286ac9ddd2094c8edcf97a2adc2d3d2659b123f88719340d3b00d9f96e9bc7c8b55192735c290e7d24683

  • SSDEEP

    192:kipkqA3KsZMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsZ8kGJ4kIWPaDFzTd

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\mig\dist\Minecraft code gen\_internal\tcl\http1.0\http.ps1"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2168-4-0x000007FEF53FE000-0x000007FEF53FF000-memory.dmp

    Filesize

    4KB

  • memory/2168-5-0x000000001B630000-0x000000001B912000-memory.dmp

    Filesize

    2.9MB

  • memory/2168-7-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

    Filesize

    9.6MB

  • memory/2168-6-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

    Filesize

    32KB

  • memory/2168-8-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

    Filesize

    9.6MB

  • memory/2168-9-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

    Filesize

    9.6MB

  • memory/2168-10-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

    Filesize

    9.6MB

  • memory/2168-11-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

    Filesize

    9.6MB