e903253b73d3e43e98088dce800bd5fb75c9b2786153c6d0150080c1d002bbb3

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 11:13

Target

temp/CS4.9/Cobalt_Strike.vbs
Size

80B
MD5

f1a09f277b7a32831721f27b9dfdac41
SHA1

5b9790a3a7d309344ea38d29aad11cebd3349d54
SHA256

62562ce3faf7abea23e0cbe69293e61aa307ddc28d1e3329cf373dc009fc396b
SHA512

b13f2f18f204ffb190f2d1a70ebe9b2785ea07e45217d5b8a100178dcb27ec2213d1fcb341f1ea6f48e8b8d395ab68e3de3a4f6647c24e8b165027582e1e4f9d

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2312	java.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1736	2072	WScript.exe	31
PID 2072 wrote to memory of 1736	2072	WScript.exe	31
PID 2072 wrote to memory of 1736	2072	WScript.exe	31
PID 1736 wrote to memory of 2312	1736	cmd.exe	33
PID 1736 wrote to memory of 2312	1736	cmd.exe	33
PID 1736 wrote to memory of 2312	1736	cmd.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp\CS4.9\Cobalt_Strike.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Cobalt_Strike.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\java.exe
    java -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -javaagent:uHook.jar -Dfile.encoding=utf-8 -jar cobaltstrike-client.jar
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2312

memory/2312-2-0x00000000027A0000-0x0000000002A10000-memory.dmp

Filesize
2.4MB

Download
memory/2312-7-0x00000000027A0000-0x0000000002A10000-memory.dmp

Filesize
2.4MB

Download