8da160520fe5cd5a2ac60cc0eb62369bd1ec4b0e0ef0a635a6eace31bd1fa5d7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 19:51

Target

run.ps1
Size

34B
MD5

c10aca1847f717fecb039e17e7ab9e1b
SHA1

4bd70814179e961812b3098174688938c6e281a2
SHA256

8da160520fe5cd5a2ac60cc0eb62369bd1ec4b0e0ef0a635a6eace31bd1fa5d7
SHA512

91c508bd9d660fe1013bca9e85ac210909df205e4ba63eebcd43b2fb43ec9c24f7aaafc97a0f103f66654ffc1c6d2f72e3d872be5705007318f13f1233ac146d

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2832	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
808	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2832	808	powershell.exe	29
PID 808 wrote to memory of 2832	808	powershell.exe	29
PID 808 wrote to memory of 2832	808	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\PING.EXE
  "C:\Windows\system32\PING.EXE" fbi.com
  2⤵
  - Runs ping.exe
  PID:2832

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/808-4-0x000000001B480000-0x000000001B762000-memory.dmp

Filesize
2.9MB

Download
memory/808-5-0x00000000020C0000-0x00000000020C8000-memory.dmp

Filesize
32KB

Download
memory/808-6-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/808-7-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/808-8-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/808-10-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/808-9-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/808-11-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download