Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
13/09/2024, 07:45
General
-
Target
iwebsns/action/event/event_update_photo.action.ps1
-
Size
1003B
-
MD5
79d0b02ab1c40a3d6023c9bfb723ca1e
-
SHA1
a7ffd0649af10ff6fdd02c19dd1a6eb79ce919c3
-
SHA256
e418e20840864f991aa945b4325231403ab07513c95281d6ab30c1e07d1a2409
-
SHA512
20ffa88b877d6523d3fd8332fd60caf5dbb937f88b6418dece422f27ef7aec5f5d959d6a7616529b3cd660ef71901eb5e15de9ae7748c07c0e0810a294c53c31
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\iwebsns\action\event\event_update_photo.action.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB