baebc0823ed891fd3c9742ebec9c43e7cfe08f595f645b6f3f1fb50cc8a2a99a

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

defender-control-main/research.ps1
Size

27KB
MD5

ebc1f8084da82c029b3dce0514c1fc66
SHA1

8f7fcd29c88f1bcc72e7103193e9c8b5c42a0d96
SHA256

1d3285454f4819b723f7d3866b92484a795582d1c1e9a6e150a122ed6f5ffe44
SHA512

ce9e70fdd81f8086fffb0aea45f8a0852869b1d9ae985f0630b5d3f6ade3fbe481a88d45176b750c45583f9d3e042dced52228065fc73852869ae195fb9023eb
SSDEEP

768:lqrrhkTneIHJmikwxBMo3Wik/FEmnNF47s2ikQWiHmr1u:lqrrhkTnzpmikwxBMo3Wik/FEmnNF47Q

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2292	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2292	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\defender-control-main\research.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-4-0x000007FEF540E000-0x000007FEF540F000-memory.dmp

Filesize
4KB

Download
memory/2292-5-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2292-6-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2292-7-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2292-8-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2292-9-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2292-11-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2292-12-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2292-10-0x0000000002D04000-0x0000000002D07000-memory.dmp

Filesize
12KB

Download