3ea95a5e6cb3985cbf325a5f5a21bddf3cec6cffac2e7478835a663b9fbf966f

Analysis

max time kernel
95s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 11:23

Target

file01.ps1
Size

147B
MD5

ed78e7fcc267a52981a252c2e7627154
SHA1

c551918e90c129f728fc2a8d2f1aa63614b2a8ee
SHA256

3ea95a5e6cb3985cbf325a5f5a21bddf3cec6cffac2e7478835a663b9fbf966f
SHA512

7e430fc36ab96e14827bec9ff2d3a78bfbe736def66ea039523fdac4841c86ad1ad4d5460a4c587588943305019b25d1a5f71ec420ed7aaa9977e28accd63efa

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
1788	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1788	powershell.exe
1788	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeIncreaseQuotaPrivilege	1788	powershell.exe
Token: SeSecurityPrivilege	1788	powershell.exe
Token: SeTakeOwnershipPrivilege	1788	powershell.exe
Token: SeLoadDriverPrivilege	1788	powershell.exe
Token: SeSystemProfilePrivilege	1788	powershell.exe
Token: SeSystemtimePrivilege	1788	powershell.exe
Token: SeProfSingleProcessPrivilege	1788	powershell.exe
Token: SeIncBasePriorityPrivilege	1788	powershell.exe
Token: SeCreatePagefilePrivilege	1788	powershell.exe
Token: SeBackupPrivilege	1788	powershell.exe
Token: SeRestorePrivilege	1788	powershell.exe
Token: SeShutdownPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeSystemEnvironmentPrivilege	1788	powershell.exe
Token: SeRemoteShutdownPrivilege	1788	powershell.exe
Token: SeUndockPrivilege	1788	powershell.exe
Token: SeManageVolumePrivilege	1788	powershell.exe
Token: 33	1788	powershell.exe
Token: 34	1788	powershell.exe
Token: 35	1788	powershell.exe
Token: 36	1788	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vxs42sja.szt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1788-0-0x00007FF89F463000-0x00007FF89F465000-memory.dmp

Filesize
8KB

Download
memory/1788-10-0x000001C5FFBF0000-0x000001C5FFC12000-memory.dmp

Filesize
136KB

Download
memory/1788-11-0x00007FF89F460000-0x00007FF89FF21000-memory.dmp

Filesize
10.8MB

Download
memory/1788-12-0x00007FF89F460000-0x00007FF89FF21000-memory.dmp

Filesize
10.8MB

Download
memory/1788-13-0x00007FF89F460000-0x00007FF89FF21000-memory.dmp

Filesize
10.8MB

Download
memory/1788-14-0x00007FF89F460000-0x00007FF89FF21000-memory.dmp

Filesize
10.8MB

Download
memory/1788-17-0x00007FF89F460000-0x00007FF89FF21000-memory.dmp

Filesize
10.8MB

Download