f09f1e068a0bf38497bd4e35e8e9b8a640c6ed4bff0c0fe9a86db2befe958f26

Analysis

max time kernel
453s
max time network
489s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
11-05-2024 11:52

Target

ShadowRatControll.cmd
Size

602B
MD5

2e2408bf86c1692a75fd83903b2cab4f
SHA1

726e9aee1fdfa97eb80e1f872b824678339fbb33
SHA256

ddccf46bc8232e081972d2754279d7480595f6f5238ed1db01bb01d43694f645
SHA512

3b71f1831a907114a512475f6a4b5cbdcad2b0e721c46d7a91cd37eab6c0bf51f2a6d6afd751065f43904fcd702fbf93a3ec6d86a2b0c6ef9f73bd44b606b7e7

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1408 powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1408 powershell.exe
1408 powershell.exe
1408 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1408 powershell.exe

pid	process
1408	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1408	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 4688 wrote to memory of 1408	4688	cmd.exe	powershell.exe
PID 4688 wrote to memory of 1408	4688	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ShadowRatControll.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4688

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n152zqrt.awm.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1408-0-0x00007FFE8C563000-0x00007FFE8C565000-memory.dmp

Filesize
8KB

Download
memory/1408-9-0x0000020A5DE30000-0x0000020A5DE52000-memory.dmp

Filesize
136KB

Download
memory/1408-10-0x00007FFE8C560000-0x00007FFE8D022000-memory.dmp

Filesize
10.8MB

Download
memory/1408-11-0x00007FFE8C560000-0x00007FFE8D022000-memory.dmp

Filesize
10.8MB

Download
memory/1408-14-0x00007FFE8C560000-0x00007FFE8D022000-memory.dmp

Filesize
10.8MB

Download
memory/1408-15-0x00007FFE8C560000-0x00007FFE8D022000-memory.dmp

Filesize
10.8MB

Download