Analysis
-
max time kernel
3s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
11/07/2024, 00:34
General
-
Target
xash/valve/overviews/frenzy.ps1
-
Size
1.3MB
-
MD5
bb453b07bc020eb862ee7ad17dd91141
-
SHA1
2d3562a2aa6034a723b48b6c0f350cd192365aae
-
SHA256
dbfc9c0e926679cf45fa23299f1ccb6f989b9de81f01d5f49179a2e0055c449b
-
SHA512
a51a910e743a3e7895c31562378732db6cb4b34456208fd5b797134356c4950ed7b41ed71928e1e48b01b7c40206765f5cbfad25280858eba8b23f1594b7d21e
-
SSDEEP
24576:M+SYuvvuwv9SI5GARmAbcRjRAUxf+N/nlzGS7zaxZsXk55EjB/E6PiBz:MJYMv79SzAR9kRAUV+NvlzGS7zO68EBs
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xash\valve\overviews\frenzy.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB