Analysis
- max time kernel
11s - max time network
13s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/06/2024, 03:00
General
- Target Aurora.Crypter.bat
- Size 15.5MB
- Sample240609-dhlj3add52
- SHA256 f83073b5c7d316632b77808423a07425fc4a9314526ebc55174cee134be2cbf0
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Aurora.Crypter.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:VUpLwGcvXV; "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0jlhdklm.0ex.ps1
memory/5016-27-0x0000019F40230000-0x0000019F40288000-memory.dmp
memory/5016-28-0x0000019F1E8C0000-0x0000019F1E8C6000-memory.dmp
memory/5016-11-0x00007FF859890000-0x00007FF85A351000-memory.dmp
memory/5016-12-0x00007FF859890000-0x00007FF85A351000-memory.dmp
memory/5016-13-0x0000019F37C20000-0x0000019F37C64000-memory.dmp
memory/5016-14-0x0000019F37CF0000-0x0000019F37D66000-memory.dmp
memory/5016-15-0x0000019F00310000-0x0000019F00DBC000-memory.dmp
memory/5016-17-0x00007FF859890000-0x00007FF85A351000-memory.dmp
memory/5016-16-0x00007FF859890000-0x00007FF85A351000-memory.dmp
memory/5016-18-0x0000019F00DC0000-0x0000019F018AC000-memory.dmp
memory/5016-29-0x0000019F37CD0000-0x0000019F37CD8000-memory.dmp
memory/5016-19-0x00007FF879430000-0x00007FF879625000-memory.dmp
memory/5016-21-0x00007FF859890000-0x00007FF85A351000-memory.dmp
memory/5016-22-0x00007FF859890000-0x00007FF85A351000-memory.dmp
memory/5016-23-0x0000019F40130000-0x0000019F4022C000-memory.dmp
memory/5016-0-0x00007FF859893000-0x00007FF859895000-memory.dmp
memory/5016-1-0x0000019F37830000-0x0000019F37852000-memory.dmp
memory/5016-26-0x0000019F37C70000-0x0000019F37CCE000-memory.dmp
memory/5016-20-0x00007FF878E70000-0x00007FF878F2E000-memory.dmp
memory/5016-30-0x0000019F37C00000-0x0000019F37C06000-memory.dmp
memory/5016-25-0x0000019F37C10000-0x0000019F37C16000-memory.dmp
memory/5016-31-0x0000019F40290000-0x0000019F402CE000-memory.dmp
memory/5016-24-0x0000019F37BE0000-0x0000019F37C02000-memory.dmp
memory/5016-32-0x0000019F40310000-0x0000019F40F3C000-memory.dmp
memory/5016-33-0x0000019F40F40000-0x0000019F40FF2000-memory.dmp
memory/5016-35-0x0000019F41030000-0x0000019F41088000-memory.dmp
memory/5016-34-0x0000019F40FF0000-0x0000019F41026000-memory.dmp
memory/5016-36-0x0000019F41090000-0x0000019F410BE000-memory.dmp
memory/5016-37-0x00007FF7BBDA0000-0x00007FF7BBE11000-memory.dmp
memory/5016-40-0x0000000180000000-0x0000000180007000-memory.dmp
memory/5016-39-0x0000019F37CE0000-0x0000019F37CE8000-memory.dmp
memory/5016-49-0x00007FF859893000-0x00007FF859895000-memory.dmp
memory/5016-50-0x00007FF859890000-0x00007FF85A351000-memory.dmp
memory/5016-51-0x00007FF859890000-0x00007FF85A351000-memory.dmp