Overview
overview
10Static
static
10PowerToys-...ng.ps1
windows7-x64
3PowerToys-...ng.ps1
windows10-2004-x64
3PowerToys-...iX.ps1
windows7-x64
3PowerToys-...iX.ps1
windows10-2004-x64
8PowerToys-...se.ps1
windows7-x64
3PowerToys-...se.ps1
windows10-2004-x64
3PowerToys-...on.ps1
windows7-x64
3PowerToys-...on.ps1
windows10-2004-x64
3PowerToys-...on.ps1
windows7-x64
3PowerToys-...on.ps1
windows10-2004-x64
3PowerToys-...ns.ps1
windows7-x64
3PowerToys-...ns.ps1
windows10-2004-x64
3PowerToys-...es.ps1
windows7-x64
3PowerToys-...es.ps1
windows10-2004-x64
3PowerToys-...es.ps1
windows7-x64
3PowerToys-...es.ps1
windows10-2004-x64
3PowerToys-...ts.ps1
windows7-x64
3PowerToys-...ts.ps1
windows10-2004-x64
3PowerToys-...ck.ps1
windows7-x64
3PowerToys-...ck.ps1
windows10-2004-x64
3PowerToys-...ng.ps1
windows7-x64
3PowerToys-...ng.ps1
windows10-2004-x64
3PowerToys-...tor.js
windows7-x64
3PowerToys-...tor.js
windows10-2004-x64
3PowerToys-...ote.js
windows7-x64
3PowerToys-...ote.js
windows10-2004-x64
3PowerToys-...ipc.js
windows7-x64
3PowerToys-...ipc.js
windows10-2004-x64
3PowerToys-...ts.pdf
windows7-x64
1PowerToys-...ts.pdf
windows10-2004-x64
1PowerToys-...se.rtf
windows7-x64
4PowerToys-...se.rtf
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:11
Static task
static1
Behavioral task
behavioral1
Sample
PowerToys-0.79.0/.pipelines/applyXamlStyling.ps1
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
PowerToys-0.79.0/.pipelines/applyXamlStyling.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
PowerToys-0.79.0/.pipelines/installWiX.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
PowerToys-0.79.0/.pipelines/installWiX.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
PowerToys-0.79.0/.pipelines/release.ps1
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
PowerToys-0.79.0/.pipelines/release.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
PowerToys-0.79.0/.pipelines/verifyAndSetLatestVCToolsVersion.ps1
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
PowerToys-0.79.0/.pipelines/verifyAndSetLatestVCToolsVersion.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
PowerToys-0.79.0/.pipelines/verifyArm64Configuration.ps1
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
PowerToys-0.79.0/.pipelines/verifyArm64Configuration.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
PowerToys-0.79.0/.pipelines/verifyDepsJsonLibraryVersions.ps1
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
PowerToys-0.79.0/.pipelines/verifyDepsJsonLibraryVersions.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
PowerToys-0.79.0/.pipelines/verifyNoticeMdAgainstNugetPackages.ps1
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
PowerToys-0.79.0/.pipelines/verifyNoticeMdAgainstNugetPackages.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
PowerToys-0.79.0/.pipelines/verifyNugetPackages.ps1
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
PowerToys-0.79.0/.pipelines/verifyNugetPackages.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
PowerToys-0.79.0/.pipelines/verifyPossibleAssetConflicts.ps1
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
PowerToys-0.79.0/.pipelines/verifyPossibleAssetConflicts.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
PowerToys-0.79.0/.pipelines/versionAndSignCheck.ps1
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
PowerToys-0.79.0/.pipelines/versionAndSignCheck.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
PowerToys-0.79.0/.pipelines/versionSetting.ps1
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
PowerToys-0.79.0/.pipelines/versionSetting.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
PowerToys-0.79.0/doc/devdocs/modules/launcher/plugins/calculator.js
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
PowerToys-0.79.0/doc/devdocs/modules/launcher/plugins/calculator.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
PowerToys-0.79.0/doc/devdocs/modules/launcher/plugins/onenote.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
PowerToys-0.79.0/doc/devdocs/modules/launcher/plugins/onenote.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
PowerToys-0.79.0/doc/devdocs/settingsv2/runner-ipc.js
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
PowerToys-0.79.0/doc/devdocs/settingsv2/runner-ipc.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
PowerToys-0.79.0/doc/images/icons/PowerToys icon/AI/PowerToys_UWP_Assets.pdf
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
PowerToys-0.79.0/doc/images/icons/PowerToys icon/AI/PowerToys_UWP_Assets.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
PowerToys-0.79.0/installer/License.rtf
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
PowerToys-0.79.0/installer/License.rtf
Resource
win10v2004-20240508-en
General
-
Target
PowerToys-0.79.0/.pipelines/verifyDepsJsonLibraryVersions.ps1
-
Size
3KB
-
MD5
e4604137ce48231350a0412b605c5739
-
SHA1
58cb76ab26e92bf38a447662d4d0858810452f88
-
SHA256
64bc3630b923fef59d3190d97c7f3e3795dcca7c527a204265c3dc2c0095065a
-
SHA512
8a1e060a1769c72b804658c013d6d011802c26bb5fe77a31a873bc5ddfeacc1455179b177a5f1d895059853abfde402b4bc32abdc7b93a384e683319084e69c8
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1260 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1260 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\PowerToys-0.79.0\.pipelines\verifyDepsJsonLibraryVersions.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1260-4-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmpFilesize
4KB
-
memory/1260-5-0x000000001B720000-0x000000001BA02000-memory.dmpFilesize
2.9MB
-
memory/1260-6-0x0000000002780000-0x0000000002788000-memory.dmpFilesize
32KB
-
memory/1260-7-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmpFilesize
9.6MB
-
memory/1260-8-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmpFilesize
9.6MB
-
memory/1260-9-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmpFilesize
9.6MB
-
memory/1260-10-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmpFilesize
9.6MB
-
memory/1260-11-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmpFilesize
9.6MB