f06b9edda0a7249ee633ff2b469853623e307b981ec43e53ed28bde6704bcee7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiagReport.bat
Size

1KB
MD5

aea95fefd7081c61e4700d614d68c579
SHA1

f4052c3419578b04a96c1acc6a67097db4729d53
SHA256

e72d0d7f3a679701fed55a44f0c304a6dc9077567fffa2d6b6d8e02976535615
SHA512

5650d864b8b99e5f8bdbc09cefaf2935cb15a9fa8a724e284aaa9af9639344d564620c72dd0207268501ebfe50210039dbbacc9ecd609ed8e64172d9b959df5f

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2360	powershell.exe
2360	powershell.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
4980	powershell.exe
4980	powershell.exe
1504	powershell.exe
4340	powershell.exe
4340	powershell.exe
1504	powershell.exe
1504	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeIncreaseQuotaPrivilege	4340	powershell.exe
Token: SeSecurityPrivilege	4340	powershell.exe
Token: SeTakeOwnershipPrivilege	4340	powershell.exe
Token: SeLoadDriverPrivilege	4340	powershell.exe
Token: SeSystemProfilePrivilege	4340	powershell.exe
Token: SeSystemtimePrivilege	4340	powershell.exe
Token: SeProfSingleProcessPrivilege	4340	powershell.exe
Token: SeIncBasePriorityPrivilege	4340	powershell.exe
Token: SeCreatePagefilePrivilege	4340	powershell.exe
Token: SeBackupPrivilege	4340	powershell.exe
Token: SeRestorePrivilege	4340	powershell.exe
Token: SeShutdownPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeSystemEnvironmentPrivilege	4340	powershell.exe
Token: SeRemoteShutdownPrivilege	4340	powershell.exe
Token: SeUndockPrivilege	4340	powershell.exe
Token: SeManageVolumePrivilege	4340	powershell.exe
Token: 33	4340	powershell.exe
Token: 34	4340	powershell.exe
Token: 35	4340	powershell.exe
Token: 36	4340	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 756	3156	cmd.exe	88
PID 3156 wrote to memory of 756	3156	cmd.exe	88
PID 756 wrote to memory of 2896	756	net.exe	89
PID 756 wrote to memory of 2896	756	net.exe	89
PID 3156 wrote to memory of 1756	3156	cmd.exe	90
PID 3156 wrote to memory of 1756	3156	cmd.exe	90
PID 1756 wrote to memory of 2360	1756	cmd.exe	91
PID 1756 wrote to memory of 2360	1756	cmd.exe	91
PID 3156 wrote to memory of 2324	3156	cmd.exe	92
PID 3156 wrote to memory of 2324	3156	cmd.exe	92
PID 3156 wrote to memory of 4980	3156	cmd.exe	95
PID 3156 wrote to memory of 4980	3156	cmd.exe	95
PID 4980 wrote to memory of 4340	4980	powershell.exe	96
PID 4980 wrote to memory of 4340	4980	powershell.exe	96
PID 3156 wrote to memory of 1504	3156	cmd.exe	99
PID 3156 wrote to memory of 1504	3156	cmd.exe	99
PID 4340 wrote to memory of 2648	4340	powershell.exe	106
PID 4340 wrote to memory of 2648	4340	powershell.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DiagReport.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-ExecutionPolicy
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ExecutionPolicy
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-ExecutionPolicy 0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -command "&{start-process powershell -ArgumentList '-noprofile -file \"C:\Users\Admin\AppData\Local\Temp\DiagReport.ps1\"' -verb RunAs}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -file "C:\Users\Admin\AppData\Local\Temp\DiagReport.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\DiagReport-20240420-062740.txt
      4⤵
      PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-ExecutionPolicy Restricted
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d136d3411d4aa688242c53cafb993aa6

SHA1
1a81cc78e3ca445d5a5193e49ddce26d5e25179f

SHA256
00ae5433c0107cc164516c7849b4cff7b6faeb52e5afa65c01dbd8c7a5efe397

SHA512
282ea53f8093c00e8c64d253782068211f8c4187391d5078755f55dedb8825c0042173d82f489d7b6c06e88184b70e83c1e92dadb80f57bd96c95855ac6b3da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1020B

MD5
1bdc311b0966dc2d527f82ed24771dcb

SHA1
e3d997f0c0d52a1fc8bec1dcd21c1261c5128956

SHA256
73d16698897a95ace0fe4adce783bd1d8c6e4f6c0b809116695d679ed328bc99

SHA512
2d17c27267f5af85f9b7c1a827f816e01962b3ea40dd4b18e0423c21feac058e341472520719490ce3c2239da8e04f4346b87d96f1b1ff2932f846f6e740f77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6905eb65a6ffabcdcd1bf53cc5c5f027

SHA1
f22ffb0c7a65f65786fe120547041b2540011ebb

SHA256
7b4efa5d0b3138754c418d55b1ea44e6726ae474b398b1c20111a66d62020315

SHA512
7ff03b57c93e72b75c3e30860c68f72eeaccc49ba05e83361b32eda2e54f64c70c161e406a6f2e9ac1aea0139ee3c74c8041a0bf638a37ab08ee0aaa969b7bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DiagReport-20240420-062740.txt

Filesize
48KB

MD5
3d5ec3b560bf54437d0f2d19e059cf3d

SHA1
ccb25c3e7ca380af19552dd4aafee0a27709568f

SHA256
15a6a7efdc7d0ceda3bcc14d3afc937403c8a8f8c6327521f3612ace3bedfc2c

SHA512
57fea48e391ddaea6ed2ada2e85de6a93c4c094dd899cbc20c53e47b8174f52d0f4f55cc258c29da0f3de9c18d2f17245a9f7370f49213615db0f7a865fc4e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tqhjki4w.f4p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1504-46-0x000001B9FE240000-0x000001B9FE250000-memory.dmp

Filesize
64KB

Download
memory/1504-49-0x000001B9FE240000-0x000001B9FE250000-memory.dmp

Filesize
64KB

Download
memory/1504-45-0x00007FFC12830000-0x00007FFC132F1000-memory.dmp

Filesize
10.8MB

Download
memory/1504-73-0x00007FFC12830000-0x00007FFC132F1000-memory.dmp

Filesize
10.8MB

Download
memory/2324-18-0x000001CEDAE80000-0x000001CEDAE90000-memory.dmp

Filesize
64KB

Download
memory/2324-30-0x00007FFC13680000-0x00007FFC14141000-memory.dmp

Filesize
10.8MB

Download
memory/2324-17-0x000001CEDAE80000-0x000001CEDAE90000-memory.dmp

Filesize
64KB

Download
memory/2324-16-0x00007FFC13680000-0x00007FFC14141000-memory.dmp

Filesize
10.8MB

Download
memory/2360-14-0x00007FFC13680000-0x00007FFC14141000-memory.dmp

Filesize
10.8MB

Download
memory/2360-11-0x000002E1CD210000-0x000002E1CD220000-memory.dmp

Filesize
64KB

Download
memory/2360-10-0x00007FFC13680000-0x00007FFC14141000-memory.dmp

Filesize
10.8MB

Download
memory/2360-9-0x000002E1CD1A0000-0x000002E1CD1C2000-memory.dmp

Filesize
136KB

Download
memory/4340-69-0x00007FFC12830000-0x00007FFC132F1000-memory.dmp

Filesize
10.8MB

Download
memory/4340-70-0x00000187C4440000-0x00000187C4450000-memory.dmp

Filesize
64KB

Download
memory/4340-71-0x00000187C4440000-0x00000187C4450000-memory.dmp

Filesize
64KB

Download
memory/4340-74-0x00000187C4440000-0x00000187C4450000-memory.dmp

Filesize
64KB

Download
memory/4340-75-0x00000187C4440000-0x00000187C4450000-memory.dmp

Filesize
64KB

Download
memory/4340-79-0x00007FFC12830000-0x00007FFC132F1000-memory.dmp

Filesize
10.8MB

Download
memory/4980-44-0x00007FFC13680000-0x00007FFC14141000-memory.dmp

Filesize
10.8MB

Download
memory/4980-32-0x000001DE9E7C0000-0x000001DE9E7D0000-memory.dmp

Filesize
64KB

Download
memory/4980-31-0x00007FFC13680000-0x00007FFC14141000-memory.dmp

Filesize
10.8MB

Download