4b9e4bbd675a45f1a99d54bff55576ba3c6d79ab76ea30e143d89fc1543e8580

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 06:22

Target

Files/Apps/ctt.bat
Size

206B
MD5

7572c139fbfdb2a7c376581a6048b3dc
SHA1

6d58696ac2de4ef789dc153e8a6100c74967fca6
SHA256

0dd4a0a9e1521cb80ee601112d194ddb8a620f0bb86dee3bb8337174c48c27fa
SHA512

bcb42aff70d65b53da7c4701614ddabaff5d4942b755de746843cfc207ba32a425f4e1ce24ab168bd4cdf516e16cdc95987d9c3350aeb12b5d7c11d9d8dc7928

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2372 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2372 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2372 powershell.exe

pid	process
2372	powershell.exe

pid	process
2372	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2372	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1796 wrote to memory of 2132	1796	cmd.exe	fltMC.exe
PID 1796 wrote to memory of 2132	1796	cmd.exe	fltMC.exe
PID 1796 wrote to memory of 2132	1796	cmd.exe	fltMC.exe
PID 1796 wrote to memory of 2372	1796	cmd.exe	powershell.exe
PID 1796 wrote to memory of 2372	1796	cmd.exe	powershell.exe
PID 1796 wrote to memory of 2372	1796	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\ctt.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm -useb https://christitus.com/win | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2372-4-0x000007FEF5ECE000-0x000007FEF5ECF000-memory.dmp

Filesize
4KB

Download
memory/2372-5-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2372-6-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2372-7-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2372-8-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2372-9-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2372-10-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download