Analysis
- max time kernel
134s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/08/2024, 08:32
General
- Target LTSC-Add-MicrosoftStore-master/Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.appx
- Size 199KB
- Sample240822-kfrfvsxckb
- SHA256 a43b96295e82ca04a4fc4acc6c21725d7f48535c7d5d99382b561e425007c624
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:AppsFolder\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe!1⤵
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_rn5f3jff.jnn.ps1
memory/756-0-0x00007FFDAEC63000-0x00007FFDAEC65000-memory.dmp
memory/756-8-0x000001F634A50000-0x000001F634A72000-memory.dmp
memory/756-11-0x00007FFDAEC60000-0x00007FFDAF721000-memory.dmp
memory/756-12-0x00007FFDAEC60000-0x00007FFDAF721000-memory.dmp
memory/756-14-0x00007FFDAEC60000-0x00007FFDAF721000-memory.dmp
memory/756-15-0x00007FFDAEC60000-0x00007FFDAF721000-memory.dmp