Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 10:46

General

  • Target

    IEStore 1.6.7.1/admin/tabs/AdminOrders.ps1

  • Size

    31KB

  • MD5

    d1af30f4c9ddc1a962bfdcb7a2035bc2

  • SHA1

    b7075df816d79b60b6c4d532d294a535e1a507eb

  • SHA256

    2f44ba1c1fcb027e5ebabc0c135ef5ee3a7c598d17cebf4f79cb620119b84555

  • SHA512

    d8591c856d67df52693921c154a3d4e12f074968fd87927ce2b76414c83f76a67b8fd77abc65192cf84a669eecffb43254f317539b23253ec10d9d6e7ab3f0cb

  • SSDEEP

    768:FTWiMPG74jyYmC46YZS5mgP/67kNui0WgYwm8k2mX6lrnYza8S:7gVjyWYpa6Ti0WgjcKlxx

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\IEStore 1.6.7.1\admin\tabs\AdminOrders.ps1"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z4jqgmmw.42g.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2084-0-0x00007FFEE2D03000-0x00007FFEE2D05000-memory.dmp

    Filesize

    8KB

  • memory/2084-6-0x000001B079AF0000-0x000001B079B12000-memory.dmp

    Filesize

    136KB

  • memory/2084-11-0x00007FFEE2D00000-0x00007FFEE37C1000-memory.dmp

    Filesize

    10.8MB

  • memory/2084-12-0x00007FFEE2D00000-0x00007FFEE37C1000-memory.dmp

    Filesize

    10.8MB

  • memory/2084-16-0x00007FFEE2D00000-0x00007FFEE37C1000-memory.dmp

    Filesize

    10.8MB

  • memory/2084-15-0x00007FFEE2D00000-0x00007FFEE37C1000-memory.dmp

    Filesize

    10.8MB