ff517cb2d4070bbba8fe2a55c9e7b2ce09863f47828b7cdc7a88a22c85e53175

Analysis

max time kernel
124s
max time network
144s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
14/03/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uni.bat
Size

15.5MB
MD5

64bbe3030fcc80775c7705e27e20d27d
SHA1

dc9c693ce686f82d336bc269beb6440cea482acf
SHA256

ff517cb2d4070bbba8fe2a55c9e7b2ce09863f47828b7cdc7a88a22c85e53175
SHA512

ce3eb8b35274bb96d5daa584638f89f874a812dfa5a2a3c38a4fbb13404d7d7e8a461b3b1fb94ef2972e59b4fc09c259b967085aecae9c25e78f9fccc0401ef4
SSDEEP

49152:fnBOxyg+oCHxXUwCoT/5RIjSYR6a2t/1ATMd+krDJKhc5lbvW0wlQq7VhCWJR0mp:Y

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4896	4052	cmd.exe	74
PID 4052 wrote to memory of 4896	4052	cmd.exe	74
PID 4052 wrote to memory of 5032	4052	cmd.exe	75
PID 4052 wrote to memory of 5032	4052	cmd.exe	75

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:bAmlouPTfP; "
  2⤵
  PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5poyinjk.uve.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/5032-65-0x00007FFF8C650000-0x00007FFF8C6FE000-memory.dmp

Filesize
696KB

Download
memory/5032-59-0x00007FFF8E9B0000-0x00007FFF8EB8B000-memory.dmp

Filesize
1.9MB

Download
memory/5032-11-0x0000026224A80000-0x0000026224A90000-memory.dmp

Filesize
64KB

Download
memory/5032-8-0x00007FFF81F30000-0x00007FFF8291C000-memory.dmp

Filesize
9.9MB

Download
memory/5032-36-0x0000026224E40000-0x0000026224E7C000-memory.dmp

Filesize
240KB

Download
memory/5032-47-0x0000026224F00000-0x0000026224F76000-memory.dmp

Filesize
472KB

Download
memory/5032-56-0x0000026224A80000-0x0000026224A90000-memory.dmp

Filesize
64KB

Download
memory/5032-66-0x00007FFF81F30000-0x00007FFF8291C000-memory.dmp

Filesize
9.9MB

Download
memory/5032-4-0x0000026224940000-0x0000026224962000-memory.dmp

Filesize
136KB

Download
memory/5032-61-0x000002622DA30000-0x000002622E51C000-memory.dmp

Filesize
10.9MB

Download
memory/5032-9-0x0000026224A80000-0x0000026224A90000-memory.dmp

Filesize
64KB

Download
memory/5032-64-0x00007FFF8E9B0000-0x00007FFF8EB8B000-memory.dmp

Filesize
1.9MB

Download
memory/5032-58-0x000002622CF80000-0x000002622DA2C000-memory.dmp

Filesize
10.7MB

Download
memory/5032-67-0x00007FFF8E9B0000-0x00007FFF8EB8B000-memory.dmp

Filesize
1.9MB

Download
memory/5032-68-0x0000026224A80000-0x0000026224A90000-memory.dmp

Filesize
64KB

Download
memory/5032-70-0x00007FFF8E9B0000-0x00007FFF8EB8B000-memory.dmp

Filesize
1.9MB

Download
memory/5032-69-0x0000026224A80000-0x0000026224A90000-memory.dmp

Filesize
64KB

Download
memory/5032-89-0x0000026224A80000-0x0000026224A90000-memory.dmp

Filesize
64KB

Download
memory/5032-90-0x0000026224A80000-0x0000026224A90000-memory.dmp

Filesize
64KB

Download
memory/5032-98-0x00007FF611B80000-0x00007FF611BF0000-memory.dmp

Filesize
448KB

Download
memory/5032-99-0x00007FFF8C650000-0x00007FFF8C6FE000-memory.dmp

Filesize
696KB

Download
memory/5032-100-0x00007FFF8E9B0000-0x00007FFF8EB8B000-memory.dmp

Filesize
1.9MB

Download
memory/5032-101-0x00007FFF81F30000-0x00007FFF8291C000-memory.dmp

Filesize
9.9MB

Download