5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196.ps1
Size

1KB
MD5

1ec2c58c17fc606446451058a6961972
SHA1

abfd1b16246bcce8721d2c5aa85cfa354135f2ff
SHA256

5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196
SHA512

7365d26c3b74e25d18618d3042ff98fedae2d1e5db6f2c6d0a7034582141a78e5c2df949477c1169e471ced3fcf94d660b7cd8655ecd6bda2d803f1ecc0c0f17

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	796	powershell.exe

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
796	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
796	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	796	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-4-0x000007FEF572E000-0x000007FEF572F000-memory.dmp

Filesize
4KB

Download
memory/796-5-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/796-6-0x0000000000530000-0x0000000000538000-memory.dmp

Filesize
32KB

Download
memory/796-7-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/796-8-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/796-9-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/796-10-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download
memory/796-11-0x0000000002C00000-0x0000000002C0E000-memory.dmp

Filesize
56KB

Download
memory/796-12-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Filesize
9.6MB

Download