d9a0283f6e1e1bf2690fbe4c60b8bafbe971ca96f5bb754917427b1f709759ce

General

Target

dump_stage1.ps1
Size

740KB
MD5

5cffb281fe8937f26e4994f8133f7456
SHA1

5479ddb635bf9c9a5632955c7d2cd2a6047256df
SHA256

3609272795c8f8ba1275959d1457b03f6143efaaf8cd037547cd561e68763237
SHA512

12418b348819ae9b9aa1115c19723cd77964273c3b0d07225971756a3ccd1061f0db891911390847d244db3acbf1b268739275a0e3fe2a41407781443a26600e

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

powershell.exe

pid process

1100 powershell.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

1612 powershell.exe
1612 powershell.exe
1612 powershell.exe
1100 powershell.exe
1100 powershell.exe
1100 powershell.exe

pid	process
1100	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeBackupPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: 36	1100	powershell.exe
Token: SeImpersonatePrivilege	1100	powershell.exe
Token: SeIncBasePriorityPrivilege	1100	powershell.exe
Token: SeIncreaseQuotaPrivilege	1100	powershell.exe
Token: 33	1100	powershell.exe
Token: SeManageVolumePrivilege	1100	powershell.exe
Token: SeProfSingleProcessPrivilege	1100	powershell.exe
Token: SeRestorePrivilege	1100	powershell.exe
Token: SeSecurityPrivilege	1100	powershell.exe
Token: SeSystemProfilePrivilege	1100	powershell.exe
Token: SeTakeOwnershipPrivilege	1100	powershell.exe
Token: SeShutdownPrivilege	1100	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1612 wrote to memory of 1100	1612	powershell.exe	powershell.exe
PID 1612 wrote to memory of 1100	1612	powershell.exe	powershell.exe
PID 1612 wrote to memory of 1100	1612	powershell.exe	powershell.exe
PID 1612 wrote to memory of 1100	1612	powershell.exe	powershell.exe

memory/1100-63-0x0000000002550000-0x000000000319A000-memory.dmp

Filesize
12.3MB

Download
memory/1100-64-0x0000000002550000-0x000000000319A000-memory.dmp

Filesize
12.3MB

Download
memory/1100-68-0x0000000006D06000-0x0000000006D07000-memory.dmp

Filesize
4KB

Download
memory/1100-66-0x0000000006CF5000-0x0000000006D06000-memory.dmp

Filesize
68KB

Download
memory/1100-67-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Filesize
4KB

Download
memory/1100-62-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1100-65-0x0000000002550000-0x000000000319A000-memory.dmp

Filesize
12.3MB

Download
memory/1100-61-0x0000000000000000-mapping.dmp

Download
memory/1612-57-0x0000000002240000-0x0000000002242000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x000007FEFB961000-0x000007FEFB963000-memory.dmp

Filesize
8KB

Download
memory/1612-60-0x000000000224B000-0x000000000226A000-memory.dmp

Filesize
124KB

Download
memory/1612-59-0x0000000002244000-0x0000000002247000-memory.dmp

Filesize
12KB

Download
memory/1612-58-0x0000000002242000-0x0000000002244000-memory.dmp

Filesize
8KB

Download
memory/1612-56-0x000007FEF27C0000-0x000007FEF331D000-memory.dmp

Filesize
11.4MB

Download