ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiagReport.bat
Size

1KB
MD5

b82606a6afb3777d62e35e8d9850faed
SHA1

13b5cd6ce43346eacc6d8334a251b429ca8d30f7
SHA256

0843361f05255e3970ed955171c20003238756c57137fef9ac19d29fbd49f9f6
SHA512

e2852b1862d9a3aaa52367ca885951e63bf519159cb5358131792c7dcfe5b3acd8f9282279af0323804f246f853ed7627c370d2ec541452995c9177bd115e9c6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2964	powershell.exe
2096	powershell.exe
2096	powershell.exe
2740	powershell.exe
2740	powershell.exe
2740	powershell.exe
2436	powershell.exe
2424	powershell.exe
2424	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	1068	whoami.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1068	1636	cmd.exe	29
PID 1636 wrote to memory of 1068	1636	cmd.exe	29
PID 1636 wrote to memory of 1068	1636	cmd.exe	29
PID 1636 wrote to memory of 2144	1636	cmd.exe	30
PID 1636 wrote to memory of 2144	1636	cmd.exe	30
PID 1636 wrote to memory of 2144	1636	cmd.exe	30
PID 1636 wrote to memory of 2960	1636	cmd.exe	31
PID 1636 wrote to memory of 2960	1636	cmd.exe	31
PID 1636 wrote to memory of 2960	1636	cmd.exe	31
PID 2960 wrote to memory of 2964	2960	cmd.exe	32
PID 2960 wrote to memory of 2964	2960	cmd.exe	32
PID 2960 wrote to memory of 2964	2960	cmd.exe	32
PID 1636 wrote to memory of 2096	1636	cmd.exe	33
PID 1636 wrote to memory of 2096	1636	cmd.exe	33
PID 1636 wrote to memory of 2096	1636	cmd.exe	33
PID 1636 wrote to memory of 2740	1636	cmd.exe	34
PID 1636 wrote to memory of 2740	1636	cmd.exe	34
PID 1636 wrote to memory of 2740	1636	cmd.exe	34
PID 2740 wrote to memory of 2436	2740	powershell.exe	35
PID 2740 wrote to memory of 2436	2740	powershell.exe	35
PID 2740 wrote to memory of 2436	2740	powershell.exe	35
PID 1636 wrote to memory of 2424	1636	cmd.exe	37
PID 1636 wrote to memory of 2424	1636	cmd.exe	37
PID 1636 wrote to memory of 2424	1636	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DiagReport.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\system32\whoami.exe
  whoami /Groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Windows\system32\find.exe
  find "S-1-16-12288"
  2⤵
  PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-ExecutionPolicy
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ExecutionPolicy
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-ExecutionPolicy 0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -command "&{start-process powershell -ArgumentList '-noprofile -file \"C:\Users\Admin\AppData\Local\Temp\DiagReport.ps1\"' -verb RunAs}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -file "C:\Users\Admin\AppData\Local\Temp\DiagReport.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-ExecutionPolicy Restricted
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0fa226ea319801f2be125b0e071d4180

SHA1
32c47aecba15574d7904b6f7d8ca58175faae35b

SHA256
2c59caca18e8dd50d52780eb76505e818a2d913ea41db08e31794f3eb3f9b21a

SHA512
5773ea730fca8b0b044cb7e84f516404ada5fa5f42406b22c47c1f97dfb520ba0e01669de494439ab642ab8df755cd601c6d9f0ddd9495d23d407d54f90bd266

Download Submit
memory/2096-19-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2096-18-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2964-7-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2964-9-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2964-8-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2964-11-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2964-12-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2964-10-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2964-4-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2964-6-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2964-5-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download