24610513b3eef44c19a79b0b769076ecdf7e0e25c556c0f5de5c50e18c29200b

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 16:12

Target

2022-11-07-Powershell-script-to-install-Bumblebee-Peurix.ps1
Size

170B
MD5

299563c5074a9a77e4e0b85240d4237c
SHA1

ac5bdbe219f4da3378cc1ac27e9f8c6496bea970
SHA256

24610513b3eef44c19a79b0b769076ecdf7e0e25c556c0f5de5c50e18c29200b
SHA512

3768aa232326c4864c92326dc52b2fc8959e9e843ab8b22f78168fad033843e16759fdbe171bfcc2834f8d46bd61a6aa9ab0e68695237dc062eed284e8da5549

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
544	powershell.exe
544	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1956	544	powershell.exe	27
PID 544 wrote to memory of 1956	544	powershell.exe	27
PID 544 wrote to memory of 1956	544	powershell.exe	27

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2022-11-07-Powershell-script-to-install-Bumblebee-Peurix.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" /s c:\windows\tasks\bb.dll,BasicLoad
  2⤵
  PID:1956

memory/544-54-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Filesize
8KB

Download
memory/544-55-0x000007FEF37A0000-0x000007FEF41C3000-memory.dmp

Filesize
10.1MB

Download
memory/544-57-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/544-56-0x000007FEF2C40000-0x000007FEF379D000-memory.dmp

Filesize
11.4MB

Download
memory/544-58-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/544-59-0x000000000282B000-0x000000000284A000-memory.dmp

Filesize
124KB

Download
memory/544-61-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/544-62-0x000000000282B000-0x000000000284A000-memory.dmp

Filesize
124KB

Download