2a297794be590d5a50d980811b8e538da50c79abc969b4e809ebcf915deda574

Analysis

max time kernel
1562s
max time network
1563s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Add_Take_Ownership_with_Pause_to_context_menu.ps1
Size

4KB
MD5

cc92113fc2f6896b1c9d6c3f9b8b6d54
SHA1

a344a23dca1e8db605230049a016dbf252d9b744
SHA256

2a297794be590d5a50d980811b8e538da50c79abc969b4e809ebcf915deda574
SHA512

72b2fe016745710066b7b11eb0decc23c177bcce03f984d9a37dd86c408d08a97109504b16c4b2857f835f9468da77f18efb3886d4a3dac6921af3432065418e
SSDEEP

96:Na9/8Hqx8HqYVqJ0H4WT80H4WTuVqBPgoPg+:C/WCWVVqJ+++gVqh

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1892 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1892 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1892 powershell.exe

pid	process
1892	powershell.exe

pid	process
1892	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1892	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Add_Take_Ownership_with_Pause_to_context_menu.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-4-0x000007FEF537E000-0x000007FEF537F000-memory.dmp

Filesize
4KB

Download
memory/1892-5-0x000007FEF50C0000-0x000007FEF5A5D000-memory.dmp

Filesize
9.6MB

Download
memory/1892-6-0x000000001B490000-0x000000001B772000-memory.dmp

Filesize
2.9MB

Download
memory/1892-9-0x000007FEF50C0000-0x000007FEF5A5D000-memory.dmp

Filesize
9.6MB

Download
memory/1892-8-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/1892-10-0x000007FEF50C0000-0x000007FEF5A5D000-memory.dmp

Filesize
9.6MB

Download
memory/1892-7-0x000007FEF50C0000-0x000007FEF5A5D000-memory.dmp

Filesize
9.6MB

Download
memory/1892-11-0x000007FEF50C0000-0x000007FEF5A5D000-memory.dmp

Filesize
9.6MB

Download
memory/1892-12-0x000007FEF50C0000-0x000007FEF5A5D000-memory.dmp

Filesize
9.6MB

Download