159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20052/RS.ps1
Size

9KB
MD5

1a6d15c991e365d3d31e58515aa19a87
SHA1

ac32ee931d5329a354b44e79913f7b0a1e3b5bc1
SHA256

81fba68ec9cc60747337234f006f3aa891e6d5a7795030c58a09818718aedb43
SHA512

9e164db6f850de86b7ca64b2bb9eb1bd8c2a86a9dbf9679773983f56dcec64073575cb4b34f1c3c8d6c7ea57de4f648865936ccefcbf19aea59db933b7d5ccc0

Score

1^/10

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000_Classes\Local Settings powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3576 powershell.exe
3576 powershell.exe
3576 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3576 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000_Classes\Local Settings	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3576	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exeWScript.execmd.exe

description	pid	process	target process
PID 3576 wrote to memory of 3484	3576	powershell.exe	WScript.exe
PID 3576 wrote to memory of 3484	3576	powershell.exe	WScript.exe
PID 3484 wrote to memory of 2608	3484	WScript.exe	cmd.exe
PID 3484 wrote to memory of 2608	3484	WScript.exe	cmd.exe
PID 2608 wrote to memory of 416	2608	cmd.exe	cscript.exe
PID 2608 wrote to memory of 416	2608	cmd.exe	cscript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\OffScrub07.vbs" -Basic,Standard,HomeAndStudent,SmallBusiness,Pro,ProPlus,Enterprise,Ultimate,ProfessionalHybrid,BASICR,STANDARDR,HOMESTUDENTR,SMALLBUSINESSR,PROR,PROPLUSR,ENTERPRISER,ULTIMATER,PROHYBRIDR,PERSONAL,PERSONALR
2⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\OffScrub07.vbs" "-Basic,Standard,HomeAndStudent,SmallBusiness,Pro,ProPlus,Enterprise,Ultimate,ProfessionalHybrid,BASICR,STANDARDR,HOMESTUDENTR,SMALLBUSINESSR,PROR,PROPLUSR,ENTERPRISER,ULTIMATER,PROHYBRIDR,PERSONAL,PERSONALR"
3⤵
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\System32\cscript.exe
C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20052\OffScrub07.vbs" "-Basic,Standard,HomeAndStudent,SmallBusiness,Pro,ProPlus,Enterprise,Ultimate,ProfessionalHybrid,BASICR,STANDARDR,HOMESTUDENTR,SMALLBUSINESSR,PROR,PROPLUSR,ENTERPRISER,ULTIMATER,PROHYBRIDR,PERSONAL,PERSONALR"
4⤵
PID:416

memory/416-5-0x0000000000000000-mapping.dmp

Download
memory/2608-4-0x0000000000000000-mapping.dmp

Download
memory/3484-3-0x0000000000000000-mapping.dmp

Download
memory/3576-0-0x00007FFA9DAA0000-0x00007FFA9E48C000-memory.dmp

Filesize
9.9MB

Download
memory/3576-1-0x000001CC2B100000-0x000001CC2B101000-memory.dmp

Filesize
4KB

Download
memory/3576-2-0x000001CC2D530000-0x000001CC2D531000-memory.dmp

Filesize
4KB

Download