Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
18/08/2024, 14:22
General
-
Target
admin/link.mo.ps1
-
Size
2KB
-
MD5
40cf64c8a47c4a39efa9ced72935cc2a
-
SHA1
7db79305ed4583d231d6ef7601395a3595d6b5c6
-
SHA256
7c0a48e14459257c49804f709e38fa1cd0244f6f8384d46c39c475ee6fb14e28
-
SHA512
5581a99b1d7aedc745e40f2dd865444a219984d0408d68e0eb030a0a006aaa8784f4ba0c9e52c46e50785b7d907557383d5a61f53886db9d8c13369322353b2c
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\admin\link.mo.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB