Analysis

  • max time kernel
    119s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2024, 21:50

General

  • Target

    License Terms/150/LocalDB/Binn/Resources/ja-JP/terrain/atlas0.ps1

  • Size

    5.3MB

  • MD5

    fdd01ccf64078c71a34a6e3c113c96ed

  • SHA1

    54c1e5504576afd9e7d89818998107cdb4df7e63

  • SHA256

    0514e4c6527f504e96bb48e53744c1d666ae1d407bdecfd5c1169f6f668e536c

  • SHA512

    4b3b6f9353cac9b99c67a99c4f0a972f20f9aba0c436341abbebebc31f7fe5bb3c6dea1d6b747e5e84d7b5a0c33ea11e67287e81eac5351fd105bc65d938cbcd

  • SSDEEP

    49152:kuyQcreLe6nY6cdU70r3XtgMjESk3xVNLgJCoLII0ttdvILHTG7797UPFnTIug:ryQxLfY650eMjQhxoEmU7UtT6

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\License Terms\150\LocalDB\Binn\Resources\ja-JP\terrain\atlas0.ps1"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2368

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2368-4-0x000007FEF5E6E000-0x000007FEF5E6F000-memory.dmp

          Filesize

          4KB

        • memory/2368-5-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

          Filesize

          2.9MB

        • memory/2368-8-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

          Filesize

          9.6MB

        • memory/2368-7-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

          Filesize

          9.6MB

        • memory/2368-6-0x0000000001E80000-0x0000000001E88000-memory.dmp

          Filesize

          32KB

        • memory/2368-9-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

          Filesize

          9.6MB

        • memory/2368-10-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

          Filesize

          9.6MB

        • memory/2368-11-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

          Filesize

          9.6MB

        • memory/2368-12-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

          Filesize

          9.6MB