Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
11/07/2024, 14:30
General
-
Target
Harvard_Business_Review_USA_MayJune_2024/zz1Cover4.ps1
-
Size
89KB
-
MD5
eaa7a4f7869be3850d49392d0059f9b9
-
SHA1
e4c465237018edc2081d71945b3d05d456714dcf
-
SHA256
f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb
-
SHA512
451045d3701470dbe8564ae9aae21ff0b40b1739d4fb854ed26745d4f9a78b4fb47c00c482f83bc9b61e7f39fb80677a6bb2f3bae4f70993dcd72b8b303966de
-
SSDEEP
768:SpppppppppNpppppppppNpppppppppNpppppppppNpppppppppepppppppppO+pl:io99+duVpx999+duVpx9
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Harvard_Business_Review_USA_MayJune_2024\zz1Cover4.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB