6a1c2df0bd6aacd1b69d3ab82b88b71f5552beaec7c452c36af1a3fed04c5bf2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pedido de Cotação-241107.bat.exe
Size

861KB
MD5

5bb7732a7e51e72677937a5c66e73794
SHA1

8dbe997d772b107c6cfd1e1abd9f64128d65b2f7
SHA256

6a1c2df0bd6aacd1b69d3ab82b88b71f5552beaec7c452c36af1a3fed04c5bf2
SHA512

bb9eb8a6f9fb0416c2f632d3fd773bc57b8f10df87e1b570afa67b77f5b8e63794186394f307e9365c2df24efbcfa31c033c35f56dc075f18779c7c8787b48e4
SSDEEP

24576:d1k1FidMNmlUabitlah20TmL5PGe3lQOno+QHPx5/OMZ:d1k1FiUmlUaygh2O6PGe1/zQv

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2868	powershell.exe
2904	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pedido de Cotação-241107.bat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
1700	Pedido de Cotação-241107.bat.exe
2904	powershell.exe
2868	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	Pedido de Cotação-241107.bat.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2868	1700	Pedido de Cotação-241107.bat.exe	30
PID 1700 wrote to memory of 2868	1700	Pedido de Cotação-241107.bat.exe	30
PID 1700 wrote to memory of 2868	1700	Pedido de Cotação-241107.bat.exe	30
PID 1700 wrote to memory of 2868	1700	Pedido de Cotação-241107.bat.exe	30
PID 1700 wrote to memory of 2904	1700	Pedido de Cotação-241107.bat.exe	32
PID 1700 wrote to memory of 2904	1700	Pedido de Cotação-241107.bat.exe	32
PID 1700 wrote to memory of 2904	1700	Pedido de Cotação-241107.bat.exe	32
PID 1700 wrote to memory of 2904	1700	Pedido de Cotação-241107.bat.exe	32
PID 1700 wrote to memory of 2692	1700	Pedido de Cotação-241107.bat.exe	33
PID 1700 wrote to memory of 2692	1700	Pedido de Cotação-241107.bat.exe	33
PID 1700 wrote to memory of 2692	1700	Pedido de Cotação-241107.bat.exe	33
PID 1700 wrote to memory of 2692	1700	Pedido de Cotação-241107.bat.exe	33
PID 1700 wrote to memory of 2392	1700	Pedido de Cotação-241107.bat.exe	36
PID 1700 wrote to memory of 2392	1700	Pedido de Cotação-241107.bat.exe	36
PID 1700 wrote to memory of 2392	1700	Pedido de Cotação-241107.bat.exe	36
PID 1700 wrote to memory of 2392	1700	Pedido de Cotação-241107.bat.exe	36
PID 1700 wrote to memory of 2764	1700	Pedido de Cotação-241107.bat.exe	37
PID 1700 wrote to memory of 2764	1700	Pedido de Cotação-241107.bat.exe	37
PID 1700 wrote to memory of 2764	1700	Pedido de Cotação-241107.bat.exe	37
PID 1700 wrote to memory of 2764	1700	Pedido de Cotação-241107.bat.exe	37
PID 1700 wrote to memory of 3016	1700	Pedido de Cotação-241107.bat.exe	38
PID 1700 wrote to memory of 3016	1700	Pedido de Cotação-241107.bat.exe	38
PID 1700 wrote to memory of 3016	1700	Pedido de Cotação-241107.bat.exe	38
PID 1700 wrote to memory of 3016	1700	Pedido de Cotação-241107.bat.exe	38
PID 1700 wrote to memory of 3064	1700	Pedido de Cotação-241107.bat.exe	39
PID 1700 wrote to memory of 3064	1700	Pedido de Cotação-241107.bat.exe	39
PID 1700 wrote to memory of 3064	1700	Pedido de Cotação-241107.bat.exe	39
PID 1700 wrote to memory of 3064	1700	Pedido de Cotação-241107.bat.exe	39
PID 1700 wrote to memory of 1844	1700	Pedido de Cotação-241107.bat.exe	40
PID 1700 wrote to memory of 1844	1700	Pedido de Cotação-241107.bat.exe	40
PID 1700 wrote to memory of 1844	1700	Pedido de Cotação-241107.bat.exe	40
PID 1700 wrote to memory of 1844	1700	Pedido de Cotação-241107.bat.exe	40

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\npFBVXl.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\npFBVXl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7DF6.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"
  2⤵
  PID:2392
- C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"
  2⤵
  PID:3016
- C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"
  2⤵
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"
  2⤵
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7DF6.tmp

Filesize
1KB

MD5
681afa652e506ccb98dc38c89e2d70e7

SHA1
6b335cecc3844d2bcee400af84c10f281f59919e

SHA256
7b04c7e9b17fcedddda23b70d7cc2b123413a5b21c66909d8370c8f5e375ea88

SHA512
5c903745be43fafa1878ea3b6ec92e8d64aefd39b09ca5982722d55bf8acd03b7dcb0f3f20c29aabb28ce4f42c83472c1da63bf68ae1757f369ca408a3f63881

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\35098XV14NOOV4961KLD.temp

Filesize
7KB

MD5
1db7acaffa7f3b62b07e8637369453b5

SHA1
5427563749664e161d21513e751528217b3f6164

SHA256
3617ee9888987f64adeb92ba41b0d6f48cb7b0e70a06a1e5c4af877008293eb1

SHA512
baa9e561753263ddd8701869c2a4ed4a127e3b4c8eb46c99be54453f7a9fe6c7a4fea9297b5bdeef12c9969a138bf12173966bdb1b0e5435d375e64f120a0bad

Download Submit
memory/1700-0-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/1700-1-0x0000000000340000-0x000000000041C000-memory.dmp

Filesize
880KB

Download
memory/1700-2-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/1700-3-0x0000000000780000-0x000000000079C000-memory.dmp

Filesize
112KB

Download
memory/1700-4-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/1700-5-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/1700-6-0x0000000001E40000-0x0000000001ECC000-memory.dmp

Filesize
560KB

Download
memory/1700-19-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download