73737bf28fa00ea1380bf98a76f6c2ff34bf25e8b489750acccc45df8e898022

General

Target

work.ps1
Size

1.4MB
MD5

7ba4b5c5d3e3276a3cfe8d581cf7173b
SHA1

79ba87b46562e75f097c1b6d23d3b63b9160bbaa
SHA256

73737bf28fa00ea1380bf98a76f6c2ff34bf25e8b489750acccc45df8e898022
SHA512

ccccc4402edc1c333f2b11955b4c2850f5b68674e473d57521cb009e2047a46f9c57c0151b9191d4a2e3b10931723d0191bba9b299ffb3bb293ff7d6f83598c6

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow	pid	Process
14	2080	powershell.exe

Modifies registry class 9 IoCs

Processes:

powershell.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\{0205080B-0E11-0003-0609-0C0F12010407}\CLSID	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\{0205080B-0E11-0003-0609-0C0F12010407}\ = "{0205080B-0E11-0003-0609-0C0F12010407}"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\TreatAs\ = "{13020508-0B0E-1100-0306-090C0F120104}"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{13020508-0B0E-1100-0306-090C0F120104}	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\{0205080B-0E11-0003-0609-0C0F12010407}	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\{0205080B-0E11-0003-0609-0C0F12010407}\CLSID\ = "{13020508-0B0E-1100-0306-090C0F120104}"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\TreatAs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{2DEA658F-54C1-4227-AF9B-260AB5FC3543}	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	804	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	Process	procid_target
PID 804 wrote to memory of 2080	804	powershell.exe	78
PID 804 wrote to memory of 2080	804	powershell.exe	78

memory/804-119-0x000001C76F053000-0x000001C76F055000-memory.dmp

Filesize
8KB

Download
memory/804-118-0x000001C76F050000-0x000001C76F052000-memory.dmp

Filesize
8KB

Download
memory/804-120-0x000001C76F220000-0x000001C76F221000-memory.dmp

Filesize
4KB

Download
memory/804-123-0x000001C76F3D0000-0x000001C76F3D1000-memory.dmp

Filesize
4KB

Download
memory/804-142-0x000001C76F056000-0x000001C76F058000-memory.dmp

Filesize
8KB

Download
memory/804-172-0x000001C76F058000-0x000001C76F059000-memory.dmp

Filesize
4KB

Download
memory/2080-147-0x0000000000000000-mapping.dmp

Download
memory/2080-165-0x000001E3BD620000-0x000001E3BD622000-memory.dmp

Filesize
8KB

Download
memory/2080-166-0x000001E3BD623000-0x000001E3BD625000-memory.dmp

Filesize
8KB

Download
memory/2080-173-0x000001E3BD626000-0x000001E3BD628000-memory.dmp

Filesize
8KB

Download
memory/2080-892-0x000001E3BD628000-0x000001E3BD62A000-memory.dmp

Filesize
8KB

Download