Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-01-2025 02:29
General
-
Target
4154e02a0d922fefb72812b972808dbf6c3f0a9108f577b641c9a57cf8d8d342.ps1
-
Size
525KB
-
MD5
5259076d6fd45bf7ddbb866c169541db
-
SHA1
67549b5a010f40a004558b2c250829c9dc4d869b
-
SHA256
4154e02a0d922fefb72812b972808dbf6c3f0a9108f577b641c9a57cf8d8d342
-
SHA512
17faa2a63e9cc2e927f517ce34bdfc17e4d2229b9eb745dcbabd84c2800e853c4fa9fb0e2ef7420f1d259137dc37394fe0e7e7972520de79067837f7cff7cfc1
-
SSDEEP
6144:eVe/8jH/fkbaAiHnVExoyZYwOiY1LBSUkf2jFgdIVgMbJN+5PVu1Zhn6w/lAVigM:eFwoW2h7dVI42CoeUJ2z6m20VFqwg2
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\4154e02a0d922fefb72812b972808dbf6c3f0a9108f577b641c9a57cf8d8d342.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
104KB
-
Filesize
9.6MB