42c77f89ea1a298098ecf3e8939f6c5ccd005742d0482047ee26fbf56728c684

Resubmissions

23/05/2023, 13:55

23/05/2023, 13:40

23/05/2023, 13:38

23/05/2023, 12:40

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/05/2023, 13:55

Target

test.bat
Size

370B
MD5

1157be1803e2f740eec3a0c69aa44625
SHA1

5963efa7895a6748e74f0aeb94a3b3856787b8c5
SHA256

42c77f89ea1a298098ecf3e8939f6c5ccd005742d0482047ee26fbf56728c684
SHA512

04d698560789eb87f9fdbc32468557d05655558d289749f263fba4cdeb26b1cf83c214c316d60184856a935a9da757a62c361ca8e41804b59606a068a18f3899

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 828	1160	cmd.exe	29
PID 1160 wrote to memory of 828	1160	cmd.exe	29
PID 1160 wrote to memory of 828	1160	cmd.exe	29
PID 1160 wrote to memory of 1708	1160	cmd.exe	30
PID 1160 wrote to memory of 1708	1160	cmd.exe	30
PID 1160 wrote to memory of 1708	1160	cmd.exe	30
PID 1160 wrote to memory of 916	1160	cmd.exe	31
PID 1160 wrote to memory of 916	1160	cmd.exe	31
PID 1160 wrote to memory of 916	1160	cmd.exe	31
PID 1160 wrote to memory of 672	1160	cmd.exe	32
PID 1160 wrote to memory of 672	1160	cmd.exe	32
PID 1160 wrote to memory of 672	1160	cmd.exe	32
PID 1160 wrote to memory of 1100	1160	cmd.exe	33
PID 1160 wrote to memory of 1100	1160	cmd.exe	33
PID 1160 wrote to memory of 1100	1160	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:828
- C:\Windows\system32\findstr.exe
  findstr /i "10\.0\.19045\."
  2⤵
  PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:916
- C:\Windows\system32\findstr.exe
  findstr /i "6\.1\."
  2⤵
  PID:672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "irm github.com/SteavenToolBox/Windows/raw/main/SteavenToolBox7.ps1 | iex"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1100

memory/1100-58-0x000000001B100000-0x000000001B3E2000-memory.dmp

Filesize
2.9MB

Download
memory/1100-59-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/1100-60-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/1100-61-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/1100-62-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/1100-63-0x000000000249B000-0x00000000024D2000-memory.dmp

Filesize
220KB

Download