Resubmissions

28-03-2024 01:44

240328-b6bcwscg3y 7

28-03-2024 01:41

240328-b34j9sad77 7

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 01:44

General

  • Target

    Launcher.bat

  • Size

    544B

  • MD5

    17033b44988e812ebade9022cba3584f

  • SHA1

    3c98c9f36212cfeec679057cabb1ea5d4bffb1a1

  • SHA256

    deda21bef6613c01484a7c219070f1c510d96a31373a9561e31a8e45b3c94473

  • SHA512

    9f54c72cafeedb4b332e8c4d438e88475d1757ea4ffdf23d13d0f1bae55806b3fe58cf48002085f5a867c5d8906c4b7674584c4070288e35026037cdc33eb282

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Windows\system32\cacls.exe
      "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
      2⤵
        PID:4192
      • C:\Users\Admin\AppData\Local\Temp\compiler.exe
        compiler.exe config
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /sc daily /st 11:19 /f /tn WindowsSetup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
          3⤵
          • Creates scheduled task(s)
          PID:3572
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Register-ScheduledTask -TaskName 'Y3J0Nzc3' -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\network\crt.exe') -Trigger (New-ScheduledTaskTrigger -At (Get-Date).AddMinutes(1) -Once) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable) -Force"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2172
    • C:\Users\Admin\AppData\Roaming\network\crt.exe
      C:\Users\Admin\AppData\Roaming\network\crt.exe
      1⤵
      • Executes dropped EXE
      PID:2108

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_03xbtru5.xpc.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\network\crt.exe

      Filesize

      6.2MB

      MD5

      f35ee4423b41aa6ef2466f6f16c3d041

      SHA1

      032f0023e143370b55f305ddb58e7ae02d4fe2f5

      SHA256

      0c5cbf3b27197a1557ea8b8187b23009653fb825f75f1d123203391c5951acb6

      SHA512

      a501d96bf6f7442c9b70cd292ae2ccc9dfd89937342f3b9007021e2ff37a8d1973cba516ba6a5e1699b6a6f74903f335ec53898416b471793fb60eac6138da60

    • C:\Users\Admin\AppData\Roaming\network\crt.exe

      Filesize

      6.7MB

      MD5

      fe55f6b0e81e42e8117c208162ba58e2

      SHA1

      1c735c8500a36094f2060889b29e9499099460cb

      SHA256

      381b35e8922e22e05575b744b09bd0a452d039099c61ab905388cd7451bb8f4c

      SHA512

      51cb848376256eda521c52a2ebb37cd7be1845cb3061d3f57d8ee63f6ee3174822feb663c8202d1d9399e908a180a681317454ea94633a39557a8009d1e0ac5e

    • memory/2108-337-0x0000000000690000-0x0000000000B40000-memory.dmp

      Filesize

      4.7MB

    • memory/2108-338-0x0000000005460000-0x00000000054FC000-memory.dmp

      Filesize

      624KB

    • memory/2108-336-0x0000000074C00000-0x00000000753B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2172-325-0x0000000007A30000-0x0000000007AD3000-memory.dmp

      Filesize

      652KB

    • memory/2172-311-0x0000000006870000-0x00000000068BC000-memory.dmp

      Filesize

      304KB

    • memory/2172-329-0x0000000007DC0000-0x0000000007E56000-memory.dmp

      Filesize

      600KB

    • memory/2172-328-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

      Filesize

      40KB

    • memory/2172-327-0x0000000007B40000-0x0000000007B5A000-memory.dmp

      Filesize

      104KB

    • memory/2172-326-0x00000000081F0000-0x000000000886A000-memory.dmp

      Filesize

      6.5MB

    • memory/2172-293-0x0000000073600000-0x0000000073DB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2172-324-0x0000000006DF0000-0x0000000006E0E000-memory.dmp

      Filesize

      120KB

    • memory/2172-314-0x000000006FF00000-0x000000006FF4C000-memory.dmp

      Filesize

      304KB

    • memory/2172-313-0x00000000079F0000-0x0000000007A22000-memory.dmp

      Filesize

      200KB

    • memory/2172-312-0x00000000031E0000-0x00000000031F0000-memory.dmp

      Filesize

      64KB

    • memory/2172-330-0x0000000007D50000-0x0000000007D61000-memory.dmp

      Filesize

      68KB

    • memory/2172-310-0x0000000006830000-0x000000000684E000-memory.dmp

      Filesize

      120KB

    • memory/2172-309-0x0000000006430000-0x0000000006784000-memory.dmp

      Filesize

      3.3MB

    • memory/2172-333-0x0000000073600000-0x0000000073DB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2172-299-0x00000000061B0000-0x0000000006216000-memory.dmp

      Filesize

      408KB

    • memory/2172-298-0x0000000006140000-0x00000000061A6000-memory.dmp

      Filesize

      408KB

    • memory/2172-297-0x0000000005840000-0x0000000005862000-memory.dmp

      Filesize

      136KB

    • memory/2172-296-0x00000000058E0000-0x0000000005F08000-memory.dmp

      Filesize

      6.2MB

    • memory/2172-295-0x0000000005270000-0x00000000052A6000-memory.dmp

      Filesize

      216KB

    • memory/2172-294-0x00000000031E0000-0x00000000031F0000-memory.dmp

      Filesize

      64KB

    • memory/3148-24-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-62-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-29-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-30-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-31-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-32-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-33-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-36-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-37-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-35-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-40-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-41-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-39-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-42-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-38-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-34-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-43-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-44-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-45-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-46-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-52-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-53-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-54-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-51-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-50-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-49-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-48-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-47-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-55-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-56-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-57-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-58-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-59-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-60-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-61-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-28-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-63-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-166-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/3148-171-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/3148-172-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/3148-176-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/3148-268-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/3148-27-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-26-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-25-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-0-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-23-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-22-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-20-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-21-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-19-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-17-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-18-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-16-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-15-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-14-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-13-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-12-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-11-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-10-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-9-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-8-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-7-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-6-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-5-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-4-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-3-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-1-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB

    • memory/3148-2-0x000000007F9F0000-0x000000007FA00000-memory.dmp

      Filesize

      64KB