Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
10-12-2024 02:33
General
-
Target
3efff01d7236dc49abf420b40c3460c89ffb3957933ba518dc5ad60d12261c35.ps1
-
Size
182KB
-
MD5
466bd5902510f9ad176108dd1c5f7979
-
SHA1
586d8326df861aa4968495436a5e91beef85c585
-
SHA256
3efff01d7236dc49abf420b40c3460c89ffb3957933ba518dc5ad60d12261c35
-
SHA512
c2b1c10ad2bdb6f222e48e43f973e9c1c09ed66857b6e59cc2d06b26f71557d4cb5a840779633b8897fd4c37c1ab75226935e9c5d9de4e4ab2fddfa4fae93529
-
SSDEEP
3072:4EEkBxJ3JygS3lX0ctuyHKCEIqQWVUBFJHFe730zz7F0ejBW/IeDFUJHFZuyEHB3:hv5ygS3hjtuyHKCEIqQWVUBFJHFe73N7
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\3efff01d7236dc49abf420b40c3460c89ffb3957933ba518dc5ad60d12261c35.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB