Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 05:47

General

  • Target

    rakutentech-laravel-request-docs-5d28e99/src/LaravelRequestDocsToOpenApi.ps1

  • Size

    11KB

  • MD5

    bc6e44ac1f8b5faaf9853aa9aa7ba7c1

  • SHA1

    bf6edacaf76573521809c9626d865b036c4c7134

  • SHA256

    9397a09ad3547db90c0b32fa5c9358d7545e69591151727c0f8919f5549a8ccb

  • SHA512

    023b3ea5bf16a1de09d4dc01c9d9cec219ecc14ca98261d5e8719c09973390fd2d0710891f4bee9dac6791d330439e3e8ac992fedcfcc93d558741a6bc84cc61

  • SSDEEP

    192:Avcm9aeSeGD59zK9Xqa5OPVcUvjz/XgZlbYwyTgqTkSgAqTcCyL:AvcjttjvHoYwyT64

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\rakutentech-laravel-request-docs-5d28e99\src\LaravelRequestDocsToOpenApi.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2548-4-0x000007FEF604E000-0x000007FEF604F000-memory.dmp

    Filesize

    4KB

  • memory/2548-5-0x000000001B7A0000-0x000000001BA82000-memory.dmp

    Filesize

    2.9MB

  • memory/2548-6-0x00000000022C0000-0x00000000022C8000-memory.dmp

    Filesize

    32KB

  • memory/2548-7-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

    Filesize

    9.6MB

  • memory/2548-8-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

    Filesize

    9.6MB

  • memory/2548-9-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

    Filesize

    9.6MB

  • memory/2548-10-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

    Filesize

    9.6MB