159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20055/RS.ps1
Size

9KB
MD5

a06ebfbefa7fc049faf12c62ab336457
SHA1

6179b19e8aa5365ccf61575409f739d85e2af4b6
SHA256

1a1566d58e6b238dfd2c81805f9694e53afb703a24c36ecaba348cae0c238c7f
SHA512

b3a31a9655257357c62b584cafd6a7b6dd66ad877bbeb58fc2070b008d53e553c595f204c43c14e5edf3a417cead9a6dfb6d8ee7709d8b4773959e7efc39b6a3

Score

1^/10

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

4040 powershell.exe
4040 powershell.exe
4040 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4040 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4040	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exeWScript.execmd.exe

description	pid	process	target process
PID 4040 wrote to memory of 3904	4040	powershell.exe	WScript.exe
PID 4040 wrote to memory of 3904	4040	powershell.exe	WScript.exe
PID 3904 wrote to memory of 1452	3904	WScript.exe	cmd.exe
PID 3904 wrote to memory of 1452	3904	WScript.exe	cmd.exe
PID 1452 wrote to memory of 4024	1452	cmd.exe	cscript.exe
PID 1452 wrote to memory of 4024	1452	cmd.exe	cscript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\OffScrub10.vbs" ClientSuites
2⤵
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\OffScrub10.vbs" "ClientSuites"
3⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\System32\cscript.exe
C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\MicrosoftFixit20055\OffScrub10.vbs" "ClientSuites"
4⤵
PID:4024

memory/1452-4-0x0000000000000000-mapping.dmp

Download
memory/3904-3-0x0000000000000000-mapping.dmp

Download
memory/4024-5-0x0000000000000000-mapping.dmp

Download
memory/4040-0-0x00007FFAC6150000-0x00007FFAC6B3C000-memory.dmp

Filesize
9.9MB

Download
memory/4040-1-0x000001B4618A0000-0x000001B4618A1000-memory.dmp

Filesize
4KB

Download
memory/4040-2-0x000001B463A90000-0x000001B463A91000-memory.dmp

Filesize
4KB

Download