4e7889d60aa6df54e7b646e8ba30befa9bba6ddfca3ac1a5894429e0caa86295

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e7889d60aa6df54e7b646e8ba30befa9bba6ddfca3ac1a5894429e0caa86295.ps1
Size

436KB
MD5

699160a16bdf0536e0fa69adcbab1e19
SHA1

ae8a6be22f05e119e7031edc79fb4a21f1268500
SHA256

4e7889d60aa6df54e7b646e8ba30befa9bba6ddfca3ac1a5894429e0caa86295
SHA512

bf2b94320790d54a3c30a57a34877f5d5d55e918943f1180fef50901b86b61e1bd48dd8c7af0a1a82de7f0b0e2af7b65dc6471fc616846c4260811c2ddc5c145
SSDEEP

1536:TUdAHeDN4NDabDzuCO4dfk2EJdMFXa/3qYrYUF1rGs4UPDc+dl3Cz6nKd35rmDeJ:T/XrXFWHlFHhfu88S

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2476 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2476 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2476 powershell.exe

pid	process
2476	powershell.exe

pid	process
2476	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2476	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\4e7889d60aa6df54e7b646e8ba30befa9bba6ddfca3ac1a5894429e0caa86295.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-4-0x000007FEF580E000-0x000007FEF580F000-memory.dmp

Filesize
4KB

Download
memory/2476-6-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-5-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2476-10-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-9-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-8-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-7-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2476-11-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-12-0x000007FEF580E000-0x000007FEF580F000-memory.dmp

Filesize
4KB

Download
memory/2476-13-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-14-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-15-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-16-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-17-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-18-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

Filesize
9.6MB

Download