42c77f89ea1a298098ecf3e8939f6c5ccd005742d0482047ee26fbf56728c684

Resubmissions

23-05-2023 13:55

23-05-2023 13:40

23-05-2023 13:38

23-05-2023 12:40

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-05-2023 12:40

Target

test.bat
Size

370B
MD5

1157be1803e2f740eec3a0c69aa44625
SHA1

5963efa7895a6748e74f0aeb94a3b3856787b8c5
SHA256

42c77f89ea1a298098ecf3e8939f6c5ccd005742d0482047ee26fbf56728c684
SHA512

04d698560789eb87f9fdbc32468557d05655558d289749f263fba4cdeb26b1cf83c214c316d60184856a935a9da757a62c361ca8e41804b59606a068a18f3899

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2000	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1732	1520	cmd.exe	29
PID 1520 wrote to memory of 1732	1520	cmd.exe	29
PID 1520 wrote to memory of 1732	1520	cmd.exe	29
PID 1520 wrote to memory of 1528	1520	cmd.exe	30
PID 1520 wrote to memory of 1528	1520	cmd.exe	30
PID 1520 wrote to memory of 1528	1520	cmd.exe	30
PID 1520 wrote to memory of 620	1520	cmd.exe	31
PID 1520 wrote to memory of 620	1520	cmd.exe	31
PID 1520 wrote to memory of 620	1520	cmd.exe	31
PID 1520 wrote to memory of 1400	1520	cmd.exe	32
PID 1520 wrote to memory of 1400	1520	cmd.exe	32
PID 1520 wrote to memory of 1400	1520	cmd.exe	32
PID 1520 wrote to memory of 2000	1520	cmd.exe	33
PID 1520 wrote to memory of 2000	1520	cmd.exe	33
PID 1520 wrote to memory of 2000	1520	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:1732
- C:\Windows\system32\findstr.exe
  findstr /i "10\.0\.19045\."
  2⤵
  PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:620
- C:\Windows\system32\findstr.exe
  findstr /i "6\.1\."
  2⤵
  PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "irm github.com/SteavenToolBox/Windows/raw/main/SteavenToolBox7.ps1 | iex"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000

memory/2000-58-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

Filesize
2.9MB

Download
memory/2000-59-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2000-60-0x00000000027C0000-0x0000000002840000-memory.dmp

Filesize
512KB

Download
memory/2000-61-0x00000000027C0000-0x0000000002840000-memory.dmp

Filesize
512KB

Download
memory/2000-62-0x00000000027CB000-0x0000000002802000-memory.dmp

Filesize
220KB

Download