Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 20:32

General

  • Target

    drupal-6.19/includes/theme.ps1

  • Size

    68KB

  • MD5

    f9a129404a7110048681b23be674c71f

  • SHA1

    966cc74693fe0e1751e8eaa8b5c8918538378c1b

  • SHA256

    fdfb36f62efac1f9edd07140030a1f6e09114ee6b7d7b9c6acdc5303d9499351

  • SHA512

    4ba3b2e17cdb73dad491d51c344d74654a5b03d33190f2a72b68e0934e1ebec8bfd8b7f6f3b782bd3652482c9e7b365c10fe2911c4623c3c817b803c93acb09b

  • SSDEEP

    768:qQbtgOU68zKX5H2naLOarqghWTIyOu9aFHhcElMSHlXTbOuy5iyac0mvcl:qQbKOU6yOOgLgdavceTCj5iyac0

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\drupal-6.19\includes\theme.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1840-4-0x000007FEF59AE000-0x000007FEF59AF000-memory.dmp

    Filesize

    4KB

  • memory/1840-7-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

    Filesize

    9.6MB

  • memory/1840-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

    Filesize

    32KB

  • memory/1840-5-0x000000001B630000-0x000000001B912000-memory.dmp

    Filesize

    2.9MB

  • memory/1840-8-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

    Filesize

    9.6MB

  • memory/1840-9-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

    Filesize

    9.6MB

  • memory/1840-10-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

    Filesize

    9.6MB

  • memory/1840-11-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

    Filesize

    9.6MB

  • memory/1840-12-0x000007FEF56F0000-0x000007FEF608D000-memory.dmp

    Filesize

    9.6MB