Analysis

  • max time kernel
    10s
  • max time network
    0s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2024, 22:24

General

  • Target

    HΩRΞFΦ.ps1

  • Size

    4KB

  • MD5

    f73f40f6ed463d8ad6390f6038a33bf4

  • SHA1

    a4c114027c88ec85b211fa505011830436e93030

  • SHA256

    3401e021c480e5ccbc51d67dca77be0929c4fbdc18feaaf8bc198f244134d0ac

  • SHA512

    608ea8e5ef84f7e8765071c3560bd1a8ca8ae99a80a431e2539ad6fe93515e44d81640d8287e71824c587ffeca2f2f0d956914625d729ede7c2fa0b806a3a1c0

  • SSDEEP

    96:ZaVrB/VMQ1AynMPJKGz1LOcDQ9tC6lrqTNYGmGr51BV:qB/Vd1AyMPI41C/rC6rqTm2pV

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\HΩRΞFΦ.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2280-4-0x000007FEF4FDE000-0x000007FEF4FDF000-memory.dmp

    Filesize

    4KB

  • memory/2280-5-0x000000001B640000-0x000000001B922000-memory.dmp

    Filesize

    2.9MB

  • memory/2280-6-0x0000000002860000-0x0000000002868000-memory.dmp

    Filesize

    32KB

  • memory/2280-8-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-11-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-10-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-9-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-7-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-13-0x000007FEF4FDE000-0x000007FEF4FDF000-memory.dmp

    Filesize

    4KB

  • memory/2280-14-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-15-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-16-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-17-0x000007FEF4D20000-0x000007FEF56BD000-memory.dmp

    Filesize

    9.6MB