99824d3ef35b84b0fc40214867e3c54e5518491efa1c5c9d796b1acb2cbe81d7

Resubmissions

04-08-2020 12:19

03-08-2020 09:10

Target

2b4587aed40db6e44cbff092b52b841e.bat
Size

218B
MD5

c69dabb8c2f1ca155fb5fe3b0482d0a7
SHA1

b3faaf0bd82fe27b076ec814b2123cf962ead51b
SHA256

99824d3ef35b84b0fc40214867e3c54e5518491efa1c5c9d796b1acb2cbe81d7
SHA512

c5fc762e4d76e921bd55faa68fff86efe13f0b49b7cbeaaf2d4050cbb8e65f400399d84acf4056e36c8f560a8e9a7fd5b9c711fcb0ef23f65f14ea0724eef174

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/2b4587aed40db6e44cbff092b52b841e

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1124 wrote to memory of 836	1124	cmd.exe	powershell.exe
PID 1124 wrote to memory of 836	1124	cmd.exe	powershell.exe
PID 1124 wrote to memory of 836	1124	cmd.exe	powershell.exe
PID 1124 wrote to memory of 836	1124	cmd.exe	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

836 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 836 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

836 powershell.exe
836 powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 836 powershell.exe

pid	process
836	powershell.exe

description	pid	process
Token: SeDebugPrivilege	836	powershell.exe

pid	process
836	powershell.exe
836	powershell.exe

flow	pid	process
4	836	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\2b4587aed40db6e44cbff092b52b841e.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124