bb943a4b69a11e38ae79651edb071f57da2c9989d6b840eae5efcd4e722d774d

Analysis

max time kernel
1735s
max time network
1221s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 13:15

Target

Spotify/Block/BlockTheSpot.bat
Size

179B
MD5

c8a02d2ca0e333fc5aaa003ec36d252e
SHA1

3bdeb7a8715fb37063f5298d17ca5ba3529c2fc5
SHA256

72e4df5d74a0941cdfa21467a9cf0002ff1aafe9ab8cba37eb7901ce0d7d091a
SHA512

cad4289d4e363433edf579f1507fc1479474b11b0db34ef300905cf76cbae5531680dd325eea9347c7b325f73c277528b799b46610585b28cb2d5e6ac1e875f3

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 3680 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3680 powershell.exe
3680 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3680 powershell.exe

flow	pid	process
6	3680	powershell.exe

pid	process
3680	powershell.exe
3680	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3680	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1660 wrote to memory of 3680	1660	cmd.exe	powershell.exe
PID 1660 wrote to memory of 3680	1660	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Spotify\Block\BlockTheSpot.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ssy1mekq.e0f.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3680-133-0x000001F628A60000-0x000001F628A82000-memory.dmp

Filesize
136KB

Download
memory/3680-143-0x000001F628B20000-0x000001F628B30000-memory.dmp

Filesize
64KB

Download
memory/3680-144-0x000001F628B20000-0x000001F628B30000-memory.dmp

Filesize
64KB

Download
memory/3680-145-0x000001F628B20000-0x000001F628B30000-memory.dmp

Filesize
64KB

Download