75ecb486aaa682df5eca41c74f5cb830a4970ba6af0d1d21022754da9bd31361

Analysis

max time kernel
9s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

upgrade/upgrade34to40.ps1
Size

17KB
MD5

d4a7c42963faf6b722960325a8a3bdd9
SHA1

41bb0da45e8cdd1096e75873fa5253b1a6a4eca5
SHA256

15e763dc32bb44a4fd9b1ccf0094db66fc5192978d2c7ba3210ccfd6e0988e36
SHA512

f8d251c4132de0df417dbc51e772add712dc34ffcdabf72217478a2749fbcdd46706bb4eef5cf2783196b4aa18bb22d4a29cd4fd0bbc805e5af56e0e99fbb5d7
SSDEEP

384:xCYwun8DpdGq/fIhqFxCP2tN66jwzJ3xUS0ArspehmPLUH0:xCFunuGq/f9LCP2vX0ztiS4

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2464 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2464 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2464 powershell.exe

pid	process
2464	powershell.exe

pid	process
2464	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2464	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\upgrade\upgrade34to40.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-4-0x0000000077B10000-0x0000000077CB9000-memory.dmp

Filesize
1.7MB

Download
memory/2464-6-0x000000001B290000-0x000000001B572000-memory.dmp

Filesize
2.9MB

Download
memory/2464-8-0x0000000077B10000-0x0000000077CB9000-memory.dmp

Filesize
1.7MB

Download
memory/2464-7-0x0000000002460000-0x0000000002468000-memory.dmp

Filesize
32KB

Download
memory/2464-5-0x0000000077B10000-0x0000000077CB9000-memory.dmp

Filesize
1.7MB

Download
memory/2464-9-0x0000000077B10000-0x0000000077CB9000-memory.dmp

Filesize
1.7MB

Download
memory/2464-10-0x0000000077B10000-0x0000000077CB9000-memory.dmp

Filesize
1.7MB

Download