Overview

overview

10

Static

static

1

a.ps1

windows7-x64

1

a.ps1

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26-04-2024 19:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a.ps1

  • Size

    1.7MB

  • MD5

    74866dd483cd71b019dd1d3135dd95d3

  • SHA1

    6acda6bc5dbe8f27396cf204491b548ea9977247

  • SHA256

    430febf4575bb2ae4f6bd9eab575c97e7726dd3096af36c0806717e3c9bdc984

  • SHA512

    3b8f68f33b04943077990b87e51ae8cae7621f2f2094c811412e2438c9a9d9f5d6096e9c87ce262aa8564dbecba9639612de6a21c137a03d9a46facc306ec366

  • SSDEEP

    24576:tIufJMVUIdj3n2Hvoe/SrbQHNrmGUbRmsWEz/zdqn92yzXRy8YSExYY8orRlV7Np:dGvO/SvQhWJVYXUG8nPWrl+

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3008-6-0x000007FEF5240000-0x000007FEF5BDD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/3008-9-0x00000000029A0000-0x0000000002A20000-memory.dmp
    Filesize

    512KB

    Download
  • memory/3008-10-0x00000000029A0000-0x0000000002A20000-memory.dmp
    Filesize

    512KB

    Download
  • memory/3008-8-0x000007FEF5240000-0x000007FEF5BDD000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/3008-7-0x00000000029A0000-0x0000000002A20000-memory.dmp
    Filesize

    512KB

    Download
  • memory/3008-5-0x0000000001F00000-0x0000000001F08000-memory.dmp
    Filesize

    32KB

    Download
  • memory/3008-4-0x000000001B640000-0x000000001B922000-memory.dmp
    Filesize

    2.9MB

    Download
  • memory/3008-11-0x00000000029A0000-0x0000000002A20000-memory.dmp
    Filesize

    512KB

    Download
  • memory/3008-12-0x00000000029A0000-0x0000000002A20000-memory.dmp
    Filesize

    512KB

    Download
  • memory/3008-13-0x000007FEF5240000-0x000007FEF5BDD000-memory.dmp
    Filesize

    9.6MB

    Download