a1ce1dd3197b1292599010cf09eee2d15a367be7f642ef65c26f6e48eb00a242

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 10:47

Target

node.bat
Size

3KB
MD5

1beb518fe0cd85f2d6f9101c2e47c7ae
SHA1

65ab6ae5b983633f60a4404636c0de19b2c529fa
SHA256

81ae13af20a68b407c4171c498f5140f51d8f0d9cf5bf4ddcf989112e3d31297
SHA512

880534df1232044cf1cfd5dc83a3d170eac46093c8f38b19e20967cb6b2c5020994d1f3113e72a4e73917ae6f9701c4a08f57f8ebec2471e35a9111362115d5b

Score

10^/10

Language

ps1

Deobfuscated

URLs

exe.dropper

https://nodejs.org/download/release/latest-v19.x/win-x64/node.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

856 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 856 powershell.exe

pid	process
856	powershell.exe

description	pid	process
Token: SeDebugPrivilege	856	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2524 wrote to memory of 856	2524	cmd.exe	powershell.exe
PID 2524 wrote to memory of 856	2524	cmd.exe	powershell.exe
PID 2524 wrote to memory of 856	2524	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\node.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524

memory/856-4-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/856-5-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/856-6-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/856-11-0x0000000002CE0000-0x0000000002D60000-memory.dmp

Filesize
512KB

Download
memory/856-10-0x0000000002CE0000-0x0000000002D60000-memory.dmp

Filesize
512KB

Download
memory/856-9-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/856-8-0x0000000002CE0000-0x0000000002D60000-memory.dmp

Filesize
512KB

Download
memory/856-7-0x0000000002CE4000-0x0000000002CE7000-memory.dmp

Filesize
12KB

Download
memory/856-12-0x0000000002CE0000-0x0000000002D60000-memory.dmp

Filesize
512KB

Download