159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20054/RS.ps1
Size

9KB
MD5

c8c24924b5cdc42d18f20214fa42e56b
SHA1

93dc18795926b78af2a5260b3dd9cc538b93a6bd
SHA256

9924674f9544c66e154ba0ff596c6c49774be8dc79f1135a45b6629a20cb3e3f
SHA512

d494b74bce52aa2d423ed714203ed67b2ecaa3a9baa5c6bc5f2125f61e426cfb2d4362858b131ace03c1fea84c8a80745c7b31e7b21a23f5e63d21aecbce5b0c

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1424 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1424 powershell.exe

pid	process
1424	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1424	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

powershell.exeWScript.execmd.exe

description	pid	process	target process
PID 1424 wrote to memory of 1948	1424	powershell.exe	WScript.exe
PID 1424 wrote to memory of 1948	1424	powershell.exe	WScript.exe
PID 1424 wrote to memory of 1948	1424	powershell.exe	WScript.exe
PID 1948 wrote to memory of 1404	1948	WScript.exe	cmd.exe
PID 1948 wrote to memory of 1404	1948	WScript.exe	cmd.exe
PID 1948 wrote to memory of 1404	1948	WScript.exe	cmd.exe
PID 1404 wrote to memory of 468	1404	cmd.exe	cscript.exe
PID 1404 wrote to memory of 468	1404	cmd.exe	cscript.exe
PID 1404 wrote to memory of 468	1404	cmd.exe	cscript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\OffScrub03.vbs" -ALL /QUIET
2⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\OffScrub03.vbs" "-ALL" "/QUIET"
3⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\System32\cscript.exe
C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20054\OffScrub03.vbs" "-ALL" "/QUIET"
4⤵
PID:468

memory/468-9-0x0000000000000000-mapping.dmp

Download
memory/468-10-0x0000000002520000-0x0000000002524000-memory.dmp

Filesize
16KB

Download
memory/1404-7-0x0000000000000000-mapping.dmp

Download
memory/1424-0-0x000007FEF61E0000-0x000007FEF6BCC000-memory.dmp

Filesize
9.9MB

Download
memory/1424-1-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/1424-2-0x000000001AEE0000-0x000000001AEE1000-memory.dmp

Filesize
4KB

Download
memory/1424-3-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/1424-4-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1424-5-0x000000001C270000-0x000000001C271000-memory.dmp

Filesize
4KB

Download
memory/1948-6-0x0000000000000000-mapping.dmp

Download
memory/1948-8-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download