9df082131558420cde6a0c93a61c235728f49de184549260f0a3596337c07bf5

Analysis

max time kernel
54s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2022 10:03

Target

cobalt2.ps1
Size

3KB
MD5

5816bf8947b292fd5837d340fae832d0
SHA1

030b8d8abf08be5d099d8a522d3011963fd84246
SHA256

b9dc6cb759631733b4911dff24e61a73d56e47e01d218c7f219b2811cb93e249
SHA512

3968e37b2156ffa1f02681d117719670084bf1444dd09e65d2da62ae8740b1c3d040cbbf0c05c6596e281d564ebb0d392e64b644482ef49764abd7b85fd87370

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

14 852 powershell.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

4908 powershell.exe
4908 powershell.exe
852 powershell.exe
852 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4908 powershell.exe
Token: SeDebugPrivilege 852 powershell.exe

flow	pid	process
14	852	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	852	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 4908 wrote to memory of 852	4908	powershell.exe	powershell.exe
PID 4908 wrote to memory of 852	4908	powershell.exe	powershell.exe
PID 4908 wrote to memory of 852	4908	powershell.exe	powershell.exe

memory/852-139-0x0000000005650000-0x00000000056B6000-memory.dmp

Filesize
408KB

Download
memory/852-136-0x0000000004F40000-0x0000000005568000-memory.dmp

Filesize
6.2MB

Download
memory/852-142-0x0000000006400000-0x000000000641A000-memory.dmp

Filesize
104KB

Download
memory/852-141-0x0000000006D00000-0x000000000737A000-memory.dmp

Filesize
6.5MB

Download
memory/852-134-0x0000000000000000-mapping.dmp

Download
memory/852-135-0x00000000024B0000-0x00000000024E6000-memory.dmp

Filesize
216KB

Download
memory/852-138-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/852-137-0x0000000004ED0000-0x0000000004EF2000-memory.dmp

Filesize
136KB

Download
memory/852-140-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Filesize
120KB

Download
memory/4908-130-0x000001CA7C3B0000-0x000001CA7C3D2000-memory.dmp

Filesize
136KB

Download
memory/4908-132-0x00007FFADD9E0000-0x00007FFADE4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-133-0x000001CA7CD50000-0x000001CA7CF5A000-memory.dmp

Filesize
2.0MB

Download
memory/4908-131-0x000001CA7C9C0000-0x000001CA7CB36000-memory.dmp

Filesize
1.5MB

Download
memory/4908-143-0x00007FFADD9E0000-0x00007FFADE4A1000-memory.dmp

Filesize
10.8MB

Download