Analysis
- max time kernel
145s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/08/2024, 08:32
General
- Target LTSC-Add-MicrosoftStore-master/Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.appx
- Size 242KB
- Sample240822-kfrfvsxckb
- SHA256 613d74252f2680f0170220ae2808fab98c6bf181712eb3e7dad0df836ff4cc59
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:AppsFolder\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe!1⤵
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ljjsefqv.vtg.ps1
memory/1756-0-0x00007FFC5CF83000-0x00007FFC5CF85000-memory.dmp
memory/1756-1-0x00000155DEA10000-0x00000155DEA32000-memory.dmp
memory/1756-11-0x00007FFC5CF80000-0x00007FFC5DA41000-memory.dmp
memory/1756-12-0x00007FFC5CF80000-0x00007FFC5DA41000-memory.dmp
memory/1756-14-0x00007FFC5CF80000-0x00007FFC5DA41000-memory.dmp
memory/1756-15-0x00007FFC5CF80000-0x00007FFC5DA41000-memory.dmp