159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20052/RS.ps1
Size

9KB
MD5

1a6d15c991e365d3d31e58515aa19a87
SHA1

ac32ee931d5329a354b44e79913f7b0a1e3b5bc1
SHA256

81fba68ec9cc60747337234f006f3aa891e6d5a7795030c58a09818718aedb43
SHA512

9e164db6f850de86b7ca64b2bb9eb1bd8c2a86a9dbf9679773983f56dcec64073575cb4b34f1c3c8d6c7ea57de4f648865936ccefcbf19aea59db933b7d5ccc0

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1060 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1060 powershell.exe

pid	process
1060	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1060	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

powershell.exeWScript.execmd.exe

description	pid	process	target process
PID 1060 wrote to memory of 1576	1060	powershell.exe	WScript.exe
PID 1060 wrote to memory of 1576	1060	powershell.exe	WScript.exe
PID 1060 wrote to memory of 1576	1060	powershell.exe	WScript.exe
PID 1576 wrote to memory of 1460	1576	WScript.exe	cmd.exe
PID 1576 wrote to memory of 1460	1576	WScript.exe	cmd.exe
PID 1576 wrote to memory of 1460	1576	WScript.exe	cmd.exe
PID 1460 wrote to memory of 828	1460	cmd.exe	cscript.exe
PID 1460 wrote to memory of 828	1460	cmd.exe	cscript.exe
PID 1460 wrote to memory of 828	1460	cmd.exe	cscript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\OffScrub07.vbs" -Basic,Standard,HomeAndStudent,SmallBusiness,Pro,ProPlus,Enterprise,Ultimate,ProfessionalHybrid,BASICR,STANDARDR,HOMESTUDENTR,SMALLBUSINESSR,PROR,PROPLUSR,ENTERPRISER,ULTIMATER,PROHYBRIDR,PERSONAL,PERSONALR
2⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\OffScrub07.vbs" "-Basic,Standard,HomeAndStudent,SmallBusiness,Pro,ProPlus,Enterprise,Ultimate,ProfessionalHybrid,BASICR,STANDARDR,HOMESTUDENTR,SMALLBUSINESSR,PROR,PROPLUSR,ENTERPRISER,ULTIMATER,PROHYBRIDR,PERSONAL,PERSONALR"
3⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\System32\cscript.exe
C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\OffScrub07.vbs" "-Basic,Standard,HomeAndStudent,SmallBusiness,Pro,ProPlus,Enterprise,Ultimate,ProfessionalHybrid,BASICR,STANDARDR,HOMESTUDENTR,SMALLBUSINESSR,PROR,PROPLUSR,ENTERPRISER,ULTIMATER,PROHYBRIDR,PERSONAL,PERSONALR"
4⤵
PID:828

memory/828-9-0x0000000000000000-mapping.dmp

Download
memory/828-10-0x00000000025D0000-0x00000000025D4000-memory.dmp

Filesize
16KB

Download
memory/1060-0-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

Filesize
9.9MB

Download
memory/1060-1-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/1060-2-0x000000001ABB0000-0x000000001ABB1000-memory.dmp

Filesize
4KB

Download
memory/1060-3-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1060-4-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/1060-5-0x000000001C2C0000-0x000000001C2C1000-memory.dmp

Filesize
4KB

Download
memory/1460-7-0x0000000000000000-mapping.dmp

Download
memory/1576-6-0x0000000000000000-mapping.dmp

Download
memory/1576-8-0x00000000024F0000-0x00000000024F4000-memory.dmp

Filesize
16KB

Download