4ec13434944f4989f27c29121d433ada8363059c6e20a3828792a06c4171a60b

Analysis

Target

PO#_45662.vbs
Size

15KB
MD5

90161e1c823ccc2e151d0828a801d035
SHA1

3e7ca03445260eb094f4d3a5506ff953d7405d8c
SHA256

4ec13434944f4989f27c29121d433ada8363059c6e20a3828792a06c4171a60b
SHA512

cec2bacfdb81dd93a7a8f4a41444cca5be2439fff5575deff9700a09fac01b40b2394fbc995f2d1987c61668851c919586514f124a3fd396c076cab0c69fe62f

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

5 856 powershell.exe
6 856 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

856 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 856 powershell.exe

flow	pid	process
5	856	powershell.exe
6	856	powershell.exe

pid	process
856	powershell.exe

description	pid	process
Token: SeDebugPrivilege	856	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 524 wrote to memory of 856	524	WScript.exe	powershell.exe
PID 524 wrote to memory of 856	524	WScript.exe	powershell.exe
PID 524 wrote to memory of 856	524	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO#_45662.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:524

memory/524-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/856-55-0x0000000000000000-mapping.dmp

Download
memory/856-57-0x000007FEF26D0000-0x000007FEF322D000-memory.dmp

Filesize
11.4MB

Download
memory/856-59-0x0000000002922000-0x0000000002924000-memory.dmp

Filesize
8KB

Download
memory/856-58-0x0000000002920000-0x0000000002922000-memory.dmp

Filesize
8KB

Download
memory/856-60-0x0000000002924000-0x0000000002927000-memory.dmp

Filesize
12KB

Download
memory/856-61-0x000000001B790000-0x000000001BA8F000-memory.dmp

Filesize
3.0MB

Download
memory/856-62-0x000000000292B000-0x000000000294A000-memory.dmp

Filesize
124KB

Download