Resubmissions

10/04/2025, 20:28

250410-y9g16s1qw7 10

25/03/2025, 00:16

250325-akwk9s1rz7 8

Analysis

  • max time kernel
    446s
  • max time network
    447s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-en
  • resource tags

    arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/03/2025, 00:16

General

  • Target

    sd2.ps1

  • Size

    466KB

  • MD5

    606362041e5b2ac5f24b08e4955b4995

  • SHA1

    b1d0ef7fcc2b2a2a22054b1a15809ab437358cc9

  • SHA256

    1b8d49c9481293784859223356ac9c50dbd1a8db680d0f1d30d264dcceb8c3e3

  • SHA512

    77480e2c69b642d44ffbe864ae953d99374c937dae91a0b3d079d777f7669ae1132971e784e7b62a1237ac4670e6cb31a5e5c68407ff63d89902d857d17f34a9

  • SSDEEP

    12288:pGSJhxeLyoJxjOhyt9YUCqhaGe+kOWCnlFE:3

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sd2.ps1
    1⤵
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:6112

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxgjntl1.qib.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/6112-0-0x00007FFD75553000-0x00007FFD75555000-memory.dmp

          Filesize

          8KB

        • memory/6112-9-0x000001D89EDB0000-0x000001D89EDD2000-memory.dmp

          Filesize

          136KB

        • memory/6112-10-0x00007FFD75550000-0x00007FFD76012000-memory.dmp

          Filesize

          10.8MB

        • memory/6112-11-0x00007FFD75550000-0x00007FFD76012000-memory.dmp

          Filesize

          10.8MB

        • memory/6112-12-0x00007FFD75550000-0x00007FFD76012000-memory.dmp

          Filesize

          10.8MB

        • memory/6112-13-0x000001D8B72A0000-0x000001D8B72BA000-memory.dmp

          Filesize

          104KB

        • memory/6112-14-0x000001D8B7680000-0x000001D8B76D0000-memory.dmp

          Filesize

          320KB

        • memory/6112-17-0x00007FFD75550000-0x00007FFD76012000-memory.dmp

          Filesize

          10.8MB