Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-07-2024 16:13
General
-
Target
kdot.ps1
-
Size
74KB
-
MD5
0cb37de329eed6ef83d5da40ffcd03cc
-
SHA1
9713568bc1a290eca44e98dc883d3e431a3e6889
-
SHA256
06aa6e3b7c70a33192655104272687e631ef0fa1d7ba78a582ebe8c47cc3cad4
-
SHA512
6e6376729fe7b58cc281214368333f00a230d4279a50ee8bbc83f1c3041f1e2211e963b584493e029a60f972841d79d0ee29b9b91a6d281a2341b08f9c47b92b
-
SSDEEP
1536:1SDVn5ahg5yYp6zdv/5l05Qo8l01zhwZPhZcLcJS7srHX6Cx:1SDVn5Uwiv/5IQo8l01zhw5hUc9KCx
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\kdot.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB