38cd03b944e9368f595347945a7a3a3fd657601578fbd74f5954875f0db15644

Analysis

Target

direct.ps1
Size

264B
MD5

bc63701022e39b52b73a21448e6b5973
SHA1

0195f5f6163eddc5676e357b8e76aa2fa5bf013e
SHA256

38cd03b944e9368f595347945a7a3a3fd657601578fbd74f5954875f0db15644
SHA512

529d35828dfd0b8b5c380b8d11cf91c1e55d4f55c274929372ff210352519d4b0792fbe67f453d3296e2d38a1e2cdf4070d85028034556d5009d943957884f3c

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 1120 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1120 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1120 powershell.exe

flow	pid	process
6	1120	powershell.exe

pid	process
1120	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1120	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1120 wrote to memory of 1308	1120	powershell.exe	rundll32.exe
PID 1120 wrote to memory of 1308	1120	powershell.exe	rundll32.exe
PID 1120 wrote to memory of 1308	1120	powershell.exe	rundll32.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\KkV.bin DllRegisterServer
2⤵
PID:1308

memory/1120-59-0x000007FEFB681000-0x000007FEFB683000-memory.dmp

Filesize
8KB

Download
memory/1120-60-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/1120-61-0x000000001AB90000-0x000000001AB91000-memory.dmp

Filesize
4KB

Download
memory/1120-62-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1120-64-0x000000001AB14000-0x000000001AB16000-memory.dmp

Filesize
8KB

Download
memory/1120-63-0x000000001AB10000-0x000000001AB12000-memory.dmp

Filesize
8KB

Download
memory/1120-65-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/1120-66-0x000000001B750000-0x000000001B751000-memory.dmp

Filesize
4KB

Download
memory/1308-67-0x0000000000000000-mapping.dmp

Download