b692668c4cb71b1029d7a0b062fa5177fff06105da3a35c070466fa3992f7081

General

Target

1.ps1
Size

1.5MB
MD5

8336572266de59a362177d39dfd212be
SHA1

9b2cea93d845507cd7cd7abde1b5fcc8218a3d76
SHA256

b692668c4cb71b1029d7a0b062fa5177fff06105da3a35c070466fa3992f7081
SHA512

fcfcc5869e5248da747bc9a68d5cbc695892634ed81dd130a9ffbd487ce70a8a5991c6309dafc2a6f32ba2a2c2c0997d2f4fa373ac6b9e405f6636c91f5c16d4

Score

3^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeWerFault.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

powershell.exeWerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

powershell.execsc.execsc.exe

description	pid	process	target process
PID 4036 wrote to memory of 3936	4036	powershell.exe	csc.exe
PID 4036 wrote to memory of 3936	4036	powershell.exe	csc.exe
PID 3936 wrote to memory of 2700	3936	csc.exe	cvtres.exe
PID 3936 wrote to memory of 2700	3936	csc.exe	cvtres.exe
PID 4036 wrote to memory of 2100	4036	powershell.exe	csc.exe
PID 4036 wrote to memory of 2100	4036	powershell.exe	csc.exe
PID 2100 wrote to memory of 3824	2100	csc.exe	cvtres.exe
PID 2100 wrote to memory of 3824	2100	csc.exe	cvtres.exe
PID 4036 wrote to memory of 3332	4036	powershell.exe	powershell.exe
PID 4036 wrote to memory of 3332	4036	powershell.exe	powershell.exe
PID 4036 wrote to memory of 3332	4036	powershell.exe	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3544 3332 WerFault.exe powershell.exe

pid	pid_target	process	target process
3544	3332	WerFault.exe	powershell.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\00ezayrv\00ezayrv.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES86C4.tmp" "c:\Users\Admin\AppData\Local\Temp\00ezayrv\CSCD71D6A3221DB4C8B985413688D56319.TMP"
3⤵
PID:2700

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5mbdv1t3\5mbdv1t3.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES879E.tmp" "c:\Users\Admin\AppData\Local\Temp\5mbdv1t3\CSC720E609714E34FA48DFE6A385839CA2D.TMP"
3⤵
PID:3824

C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" -NonInteractive -NoProfile -file C:\Users\Admin\AppData\Local\Temp\1.ps1
2⤵
PID:3332

C:\Users\Admin\AppData\Local\Temp\00ezayrv\00ezayrv.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\5mbdv1t3\5mbdv1t3.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES86C4.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES879E.tmp

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\00ezayrv\00ezayrv.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\00ezayrv\00ezayrv.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\00ezayrv\CSCD71D6A3221DB4C8B985413688D56319.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5mbdv1t3\5mbdv1t3.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5mbdv1t3\5mbdv1t3.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5mbdv1t3\CSC720E609714E34FA48DFE6A385839CA2D.TMP

Download Submit
memory/3544-10-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/3544-11-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download