5783452b6dae0485f3fce5963779d98b7ad3192a6f999a4a57d0436e1e4d734b

Analysis

max time kernel
1329s
max time network
1447s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

windows 11 service disabler.ps1
Size

22KB
MD5

d48807109a6f2741934982e15cda1b62
SHA1

81eeafb8eef12cdf77bac7556e9443abf7caa02d
SHA256

5783452b6dae0485f3fce5963779d98b7ad3192a6f999a4a57d0436e1e4d734b
SHA512

b88bf2f033ad5295681052b2f9e5bdd33ed488a18dd8ce5079ff17a387499824398c4dd1fbfdaf9856d6a87bae6c87dbe122d095553ee1cd1167a0ff2eb1d83c
SSDEEP

384:W8VzKkimbGfP6qKUfVGhvQUOCnI+G5KTiwO4obYDLiwJwpF9Lqdd7LyuElv:WK5hvdBvG5EWULiwupF9LQdiR

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2804	powershell.exe
2804	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\windows 11 service disabler.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mxvn5gpg.q0s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\log.txt

Filesize
4KB

MD5
ea5e69eeaa3776439b764e29cff3aa6d

SHA1
c1c85f6034d126940ab04539ac14d2d91be40908

SHA256
69f778a66bcf01ed683a5f05b76c63429b463e934812d394ca27e839a96cf9a3

SHA512
d916d7af4faad84f859891f581ca83a8418b2ed4c02bcddc9c739d7a91997c543b468a9c3e74bb629b15f77c1799fe2c81ca99044c4eb08866935f7883e872da

Download Submit
C:\Users\Admin\AppData\Local\Temp\log.txt

Filesize
2KB

MD5
7e89e1d438b402a874cee18b366592e8

SHA1
3852643d5e80fa79e7a5a4bd21349db6800b7c4f

SHA256
5b3be0122b756147622c8f0d263e916fb53e8073832ad3a3001db9adb166a255

SHA512
fcd9efc1f7ad041200d3f4e3910998fe9f1d2ae6c71893f546107f8aa1e609701bb60beaeeaf39c6de0366aaf50b1cc5e69a6a65e51a23f7f0b57ed7a7536ba1

Download Submit
memory/2804-0-0x00007FFBB6D93000-0x00007FFBB6D95000-memory.dmp

Filesize
8KB

Download
memory/2804-1-0x0000021836070000-0x0000021836092000-memory.dmp

Filesize
136KB

Download
memory/2804-11-0x00007FFBB6D90000-0x00007FFBB7851000-memory.dmp

Filesize
10.8MB

Download
memory/2804-12-0x00007FFBB6D90000-0x00007FFBB7851000-memory.dmp

Filesize
10.8MB

Download
memory/2804-178-0x00007FFBB6D90000-0x00007FFBB7851000-memory.dmp

Filesize
10.8MB

Download
memory/2804-295-0x00007FFBB6D93000-0x00007FFBB6D95000-memory.dmp

Filesize
8KB

Download
memory/2804-296-0x00007FFBB6D90000-0x00007FFBB7851000-memory.dmp

Filesize
10.8MB

Download
memory/2804-426-0x00007FFBB6D90000-0x00007FFBB7851000-memory.dmp

Filesize
10.8MB

Download