f06b9edda0a7249ee633ff2b469853623e307b981ec43e53ed28bde6704bcee7

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiagReport.bat
Size

1KB
MD5

aea95fefd7081c61e4700d614d68c579
SHA1

f4052c3419578b04a96c1acc6a67097db4729d53
SHA256

e72d0d7f3a679701fed55a44f0c304a6dc9077567fffa2d6b6d8e02976535615
SHA512

5650d864b8b99e5f8bdbc09cefaf2935cb15a9fa8a724e284aaa9af9639344d564620c72dd0207268501ebfe50210039dbbacc9ecd609ed8e64172d9b959df5f

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1376	powershell.exe
2500	powershell.exe
2500	powershell.exe
2504	powershell.exe
2504	powershell.exe
2504	powershell.exe
2864	powershell.exe
2732	powershell.exe
2732	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1788	2292	cmd.exe	29
PID 2292 wrote to memory of 1788	2292	cmd.exe	29
PID 2292 wrote to memory of 1788	2292	cmd.exe	29
PID 1788 wrote to memory of 2728	1788	net.exe	30
PID 1788 wrote to memory of 2728	1788	net.exe	30
PID 1788 wrote to memory of 2728	1788	net.exe	30
PID 2292 wrote to memory of 2128	2292	cmd.exe	31
PID 2292 wrote to memory of 2128	2292	cmd.exe	31
PID 2292 wrote to memory of 2128	2292	cmd.exe	31
PID 2128 wrote to memory of 1376	2128	cmd.exe	32
PID 2128 wrote to memory of 1376	2128	cmd.exe	32
PID 2128 wrote to memory of 1376	2128	cmd.exe	32
PID 2292 wrote to memory of 2500	2292	cmd.exe	33
PID 2292 wrote to memory of 2500	2292	cmd.exe	33
PID 2292 wrote to memory of 2500	2292	cmd.exe	33
PID 2292 wrote to memory of 2504	2292	cmd.exe	34
PID 2292 wrote to memory of 2504	2292	cmd.exe	34
PID 2292 wrote to memory of 2504	2292	cmd.exe	34
PID 2504 wrote to memory of 2864	2504	powershell.exe	35
PID 2504 wrote to memory of 2864	2504	powershell.exe	35
PID 2504 wrote to memory of 2864	2504	powershell.exe	35
PID 2292 wrote to memory of 2732	2292	cmd.exe	37
PID 2292 wrote to memory of 2732	2292	cmd.exe	37
PID 2292 wrote to memory of 2732	2292	cmd.exe	37
PID 2864 wrote to memory of 2280	2864	powershell.exe	39
PID 2864 wrote to memory of 2280	2864	powershell.exe	39
PID 2864 wrote to memory of 2280	2864	powershell.exe	39

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DiagReport.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-ExecutionPolicy
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ExecutionPolicy
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-ExecutionPolicy 0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -command "&{start-process powershell -ArgumentList '-noprofile -file \"C:\Users\Admin\AppData\Local\Temp\DiagReport.ps1\"' -verb RunAs}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -file "C:\Users\Admin\AppData\Local\Temp\DiagReport.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\DiagReport-20240420-062739.txt
      4⤵
      PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-ExecutionPolicy Restricted
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DiagReport-20240420-062739.txt

Filesize
42KB

MD5
70d9b2954d64907dd2170a810f32be15

SHA1
b2db3b13362817e5877800f63cc15d7408f32583

SHA256
d6aaeb77c8fe91d96d3719e3f0bdc424021c9f20b9fd470edfba268e9c5e611e

SHA512
1e2052355ab51046caf1e66a2bf081219d40ff52e0475cede7f654fbcd3754770965d1d75ec93e88ad796bff101a5c40b86a08af1c3fd7d9be005193f50b88ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0b40e9d2d6671539a4172f8d1b1b4f24

SHA1
4130b94eba7416c231699ca9427e4ffee8b9805f

SHA256
ca605fc88fd46d6b6bfd857cee8bc1f2eba12aba974d6de77c730f47217d6ce8

SHA512
e30ba06bea03321051ea15e3b159974bd87ef27b02ba699dea9c1233261b74e7d284999db8559a0d4b2ab9cd4276b515b4a83d45712539e5bb50a0145e5972b0

Download Submit
memory/1376-5-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/1376-6-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/1376-7-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/1376-8-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/1376-10-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/1376-11-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/1376-9-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/1376-12-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/1376-4-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2500-18-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2500-22-0x000007FEF4F90000-0x000007FEF592D000-memory.dmp

Filesize
9.6MB

Download
memory/2500-20-0x0000000002BA0000-0x0000000002C20000-memory.dmp

Filesize
512KB

Download
memory/2500-24-0x0000000002BA0000-0x0000000002C20000-memory.dmp

Filesize
512KB

Download
memory/2500-23-0x0000000002BA0000-0x0000000002C20000-memory.dmp

Filesize
512KB

Download
memory/2500-25-0x0000000002BA0000-0x0000000002C20000-memory.dmp

Filesize
512KB

Download
memory/2500-26-0x000007FEF4F90000-0x000007FEF592D000-memory.dmp

Filesize
9.6MB

Download
memory/2500-21-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2500-19-0x000007FEF4F90000-0x000007FEF592D000-memory.dmp

Filesize
9.6MB

Download
memory/2504-34-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2504-35-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2504-36-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2504-37-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2504-38-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2504-33-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2732-60-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2732-57-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2732-61-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2732-58-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2732-56-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2732-55-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-50-0x00000000028D0000-0x0000000002950000-memory.dmp

Filesize
512KB

Download
memory/2864-47-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-44-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2864-59-0x00000000028D0000-0x0000000002950000-memory.dmp

Filesize
512KB

Download
memory/2864-46-0x00000000028D0000-0x0000000002950000-memory.dmp

Filesize
512KB

Download
memory/2864-48-0x00000000028D0000-0x0000000002950000-memory.dmp

Filesize
512KB

Download
memory/2864-45-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-64-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-65-0x00000000028D0000-0x0000000002950000-memory.dmp

Filesize
512KB

Download