20d67deb420501f22ab720556743178aa140ed506fb4ea71a61d1c0072f6d75c

Analysis

max time kernel
137s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/08/2024, 16:33

Target

WindowsOptimizations-main/System/CPUProcessOptimizations.ps1
Size

2KB
MD5

0b02248ef0e5006443411bc70f6647c2
SHA1

5fe43a617cebb810412c90cf5949950225e6e5ee
SHA256

9705a76dac443ff0418ad58afad98d02b166fe3d335434b94e7581b373d8a9b2
SHA512

465172afbc97a012374a0c433a489f959835ef89ca3607495265ebc827ad126b37818671a9c2ad99f2bf805abdfcfbdbdcfbb43549e353b182ba89b1b39844e2

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
4704	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeIncreaseQuotaPrivilege	4704	powershell.exe
Token: SeSecurityPrivilege	4704	powershell.exe
Token: SeTakeOwnershipPrivilege	4704	powershell.exe
Token: SeLoadDriverPrivilege	4704	powershell.exe
Token: SeSystemProfilePrivilege	4704	powershell.exe
Token: SeSystemtimePrivilege	4704	powershell.exe
Token: SeProfSingleProcessPrivilege	4704	powershell.exe
Token: SeIncBasePriorityPrivilege	4704	powershell.exe
Token: SeCreatePagefilePrivilege	4704	powershell.exe
Token: SeBackupPrivilege	4704	powershell.exe
Token: SeRestorePrivilege	4704	powershell.exe
Token: SeShutdownPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeSystemEnvironmentPrivilege	4704	powershell.exe
Token: SeRemoteShutdownPrivilege	4704	powershell.exe
Token: SeUndockPrivilege	4704	powershell.exe
Token: SeManageVolumePrivilege	4704	powershell.exe
Token: 33	4704	powershell.exe
Token: 34	4704	powershell.exe
Token: 35	4704	powershell.exe
Token: 36	4704	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_smvvybdg.ayo.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/4704-4-0x00007FFB141D3000-0x00007FFB141D4000-memory.dmp

Filesize
4KB

Download
memory/4704-5-0x0000017EDCBC0000-0x0000017EDCBE2000-memory.dmp

Filesize
136KB

Download
memory/4704-8-0x00007FFB141D0000-0x00007FFB14BBC000-memory.dmp

Filesize
9.9MB

Download
memory/4704-9-0x0000017EDCD90000-0x0000017EDCE06000-memory.dmp

Filesize
472KB

Download
memory/4704-10-0x00007FFB141D0000-0x00007FFB14BBC000-memory.dmp

Filesize
9.9MB

Download
memory/4704-179-0x0000017EDD110000-0x0000017EDD13A000-memory.dmp

Filesize
168KB

Download
memory/4704-198-0x0000017EDD110000-0x0000017EDD132000-memory.dmp

Filesize
136KB

Download
memory/4704-214-0x00007FFB141D0000-0x00007FFB14BBC000-memory.dmp

Filesize
9.9MB

Download
memory/4704-215-0x00007FFB141D0000-0x00007FFB14BBC000-memory.dmp

Filesize
9.9MB

Download