e91236b12aceede8766ceacf7b8a621e1a038ad63bde18d3fa865c21a5e89f24

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:12

Target

run.ps1
Size

118B
MD5

5d456509b1a0324b8eba93096af9f154
SHA1

4fef5fa85071ec5ec28cf147dd6e49918040449f
SHA256

e91236b12aceede8766ceacf7b8a621e1a038ad63bde18d3fa865c21a5e89f24
SHA512

1276fda02552024ddc8701ce5852be6b7a9bd4cc7a86d49b92233f819b96eeec0395297e111737b86789a9ba536489756c0a18d7ecd0d7de366148c06ac2f2e0

Score

1^/10

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

pid	Process
2792	PING.EXE
2692	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2608	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2792	2608	powershell.exe	28
PID 2608 wrote to memory of 2792	2608	powershell.exe	28
PID 2608 wrote to memory of 2792	2608	powershell.exe	28
PID 2608 wrote to memory of 2692	2608	powershell.exe	31
PID 2608 wrote to memory of 2692	2608	powershell.exe	31
PID 2608 wrote to memory of 2692	2608	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\PING.EXE
  "C:\Windows\system32\PING.EXE" fbi.gov
  2⤵
  - Runs ping.exe
  PID:2792
- C:\Windows\system32\PING.EXE
  "C:\Windows\system32\PING.EXE" fbi.gov
  2⤵
  - Runs ping.exe
  PID:2692

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2608-4-0x000000001B1E0000-0x000000001B4C2000-memory.dmp

Filesize
2.9MB

Download
memory/2608-5-0x000007FEF56C0000-0x000007FEF605D000-memory.dmp

Filesize
9.6MB

Download
memory/2608-6-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2608-7-0x000007FEF56C0000-0x000007FEF605D000-memory.dmp

Filesize
9.6MB

Download
memory/2608-9-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2608-10-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2608-8-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2608-11-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2608-12-0x000007FEF56C0000-0x000007FEF605D000-memory.dmp

Filesize
9.6MB

Download
memory/2608-13-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2608-14-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2608-15-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2608-16-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2608-17-0x000007FEF56C0000-0x000007FEF605D000-memory.dmp

Filesize
9.6MB

Download