20d67deb420501f22ab720556743178aa140ed506fb4ea71a61d1c0072f6d75c

Analysis

max time kernel
86s
max time network
105s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
02-08-2024 16:33

Target

WindowsOptimizations-main/System/GPUThreadPriorityOptimizations.ps1
Size

1KB
MD5

9ce5af47c48b1ee4b4f658e362f2a6f6
SHA1

a5c5bdc05de360e77dca56a240e641f155093cc5
SHA256

d5448fe984065ab53221b30049e1cd4bcd6d69b1f42dea55be79b22a1f90cf24
SHA512

d620ae1c0d3b70ac5629d8e18077db5cbb02d06ec9526bfe3488725945e0f0b0b65c8e4663a5cdb8e3ced7ebf01d55b4db5f936d19f88bc69d0e8c1760650645

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
2848	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeIncreaseQuotaPrivilege	2848	powershell.exe
Token: SeSecurityPrivilege	2848	powershell.exe
Token: SeTakeOwnershipPrivilege	2848	powershell.exe
Token: SeLoadDriverPrivilege	2848	powershell.exe
Token: SeSystemProfilePrivilege	2848	powershell.exe
Token: SeSystemtimePrivilege	2848	powershell.exe
Token: SeProfSingleProcessPrivilege	2848	powershell.exe
Token: SeIncBasePriorityPrivilege	2848	powershell.exe
Token: SeCreatePagefilePrivilege	2848	powershell.exe
Token: SeBackupPrivilege	2848	powershell.exe
Token: SeRestorePrivilege	2848	powershell.exe
Token: SeShutdownPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeSystemEnvironmentPrivilege	2848	powershell.exe
Token: SeRemoteShutdownPrivilege	2848	powershell.exe
Token: SeUndockPrivilege	2848	powershell.exe
Token: SeManageVolumePrivilege	2848	powershell.exe
Token: 33	2848	powershell.exe
Token: 34	2848	powershell.exe
Token: 35	2848	powershell.exe
Token: 36	2848	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qddbmxbe.b4p.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/2848-3-0x00007FFF8BF33000-0x00007FFF8BF34000-memory.dmp

Filesize
4KB

Download
memory/2848-5-0x000001DD424E0000-0x000001DD42502000-memory.dmp

Filesize
136KB

Download
memory/2848-8-0x00007FFF8BF30000-0x00007FFF8C91C000-memory.dmp

Filesize
9.9MB

Download
memory/2848-9-0x000001DD5A9F0000-0x000001DD5AA66000-memory.dmp

Filesize
472KB

Download
memory/2848-12-0x00007FFF8BF30000-0x00007FFF8C91C000-memory.dmp

Filesize
9.9MB

Download
memory/2848-198-0x000001DD42560000-0x000001DD42582000-memory.dmp

Filesize
136KB

Download
memory/2848-179-0x000001DD42560000-0x000001DD4258A000-memory.dmp

Filesize
168KB

Download
memory/2848-210-0x00007FFF8BF30000-0x00007FFF8C91C000-memory.dmp

Filesize
9.9MB

Download
memory/2848-211-0x00007FFF8BF30000-0x00007FFF8C91C000-memory.dmp

Filesize
9.9MB

Download