Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29/05/2024, 14:15
Behavioral task
behavioral1
Sample
BombPartyUltra.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
BombPartyUltra/ARunALL.bat
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
BombPartyUltra/BombParty.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
BombParty.pyc
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
BombPartyUltra/EWordList.txt
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
BombPartyUltra/FWordlist.txt
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
BombPartyUltra/ZInstallPython.bat
Resource
win10-20240404-en
General
-
Target
BombPartyUltra/ZInstallPython.bat
-
Size
686B
-
MD5
f30718a354e7cc104ea553ce5ae2d486
-
SHA1
3876134e6b92da57a49d868013ed35b5d946f8fd
-
SHA256
94008c8135d149fecd29ca62aded487f0fbfa6af893596ffc3e4b621a0fe4966
-
SHA512
601b2256ea709a885741f1dec5c97dda6fb7fd4e485b4afac3503af1aefe73472e5bc5529c144814a3defbc0b51ac4b50e02a50dccc69b41ee5d87a3f4282874
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2580 powershell.exe -
pid Process 2580 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2580 powershell.exe 2580 powershell.exe 2580 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2580 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4388 wrote to memory of 4676 4388 cmd.exe 75 PID 4388 wrote to memory of 4676 4388 cmd.exe 75 PID 4676 wrote to memory of 2580 4676 cmd.exe 76 PID 4676 wrote to memory of 2580 4676 cmd.exe 76
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BombPartyUltra\ZInstallPython.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"2⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a