2b9bd18500ea9ff7b8009b09fcd07f1acae0f4ca30c149c6df07be300a6a1ada

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 02:55

Target

jkshdy.dll.bat
Size

1KB
MD5

0e94b81e5a0e659e20c323ae9169b4e2
SHA1

f5073196909937218c7323fcdc68c160b2afdc56
SHA256

07e1d3a42ac1e36e7ce6faaee7ad3bd85cab10b7a8b3151a39fd1cdbc726db72
SHA512

14c96290e724d8b8aa6c46c9a4fbb6ad9e7e88653fefed7fb368aac91bce85e4d654e04d94575aaf8eca40dbe6b311647b9f3dbacd7279ba4d2a7c9acfcbb638

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
316	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 316	5100	cmd.exe	89
PID 5100 wrote to memory of 316	5100	cmd.exe	89
PID 5100 wrote to memory of 4912	5100	cmd.exe	93
PID 5100 wrote to memory of 4912	5100	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jkshdy.dll.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 2
  2⤵
  - Runs ping.exe
  PID:316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File C:\Users\service.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z1dpjhrs.0av.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\service.ps1

Filesize
789B

MD5
aa2cd59ea141ff113f958c07463c6868

SHA1
3763ef8a8f3db01edec2d07c1a020ad42adf890d

SHA256
ab2df8cb646673257a9bcb55c4749afe0d112fc37729e23abd9b8adf33432c98

SHA512
847020a4124a4717be57a04edcfb7ae0becae481084f091c6fa31413498bf410ba482a5bae9b0adbe30db0f5c5585f964851e224a38c47fe75a7943f20c1129f

Download Submit
memory/4912-10-0x000001E8F7270000-0x000001E8F7292000-memory.dmp

Filesize
136KB

Download
memory/4912-11-0x00007FFFD74D0000-0x00007FFFD7F91000-memory.dmp

Filesize
10.8MB

Download
memory/4912-12-0x000001E8F7160000-0x000001E8F7170000-memory.dmp

Filesize
64KB

Download
memory/4912-13-0x000001E8F7160000-0x000001E8F7170000-memory.dmp

Filesize
64KB

Download
memory/4912-17-0x00007FFFD74D0000-0x00007FFFD7F91000-memory.dmp

Filesize
10.8MB

Download