Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
19-08-2024 02:19
General
-
Target
upload/dede/archives_edit.ps1
-
Size
5KB
-
MD5
03a042f1656478f45816d1874a818387
-
SHA1
fc1b4b7e818297e6e69e9af85570497ca6ce9ab6
-
SHA256
970c68529c24997dc6e0e58f59d876ae9e4379eac651a827ff553b562bfbf686
-
SHA512
c9aebcb8f0f7e40802407da027c6542d26d7e564477df5c63e485c9ab0b0d704efc790b2032567df8b5718f57a150c4d46898770d62c1bde5c4b609790b23b02
-
SSDEEP
96:iOL++bmRMssOTK/qcB+07eljeDqyBH8bLrMNn8TaUSaVK1LTAYMo5vkCjV9xVqOO:7rSRLPm+0abfrKFdM6xjgUj5A
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\upload\dede\archives_edit.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB